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FOREWORD 


This document constitutes the final report of the ACT/Control/Guidance System 
Definition Task of the Integrated Application of Active Controls (IAAC) Technology to an 
Advanced Subsonic Transport Project. The report covers work performed from 
December 1980 through January 1982 under Contract NAS1-15325. 

Volume I contains the principal results of the study, and supplementary technical data are 
contained in Volume II. 

The NASA Technical Monitor for this contract task was D. B. Middleton of the Energy 
Efficient Transport Project Office at Langley Research Center. 

The work was accomplished within the Preliminary Design and Engineering Technology 
Departments of the Vice President— Engineering organization of Boeing Commercial 
Airplane Company. Key contractor personnel who contributed were: 


G. W. Hanks 

Program Manager 

H. A. Shomber 

IAAC Project Manager 

A. F. Norwood 

Preliminary Design Programs and Research Systems 

L. W. Robinson 

Task Manager 

R. L. Erwin, Jr. 

Air Traffic Control Analysis 

J. H. Foster 

Air Traffic Control Analysis 

J. L. Groce 

Air Traffic Control Analysis 

J. G. Hatcher 

Crew Systems Technology 

J. M. Kraus 

Crew Systems Technology 

D. L. Parks 

Crew Systems Technology 

T. A. Pfaff 

Crew Systems Technology 

W. D. Smith 

Crew Systems Technology 

R. C. Wilcox 

Crew Systems Technology 

C. B. Crumb, Jr. 

Flight Controls Design 

W. F. Yee 

Flight Controls Design 

C. C. Flora 

Flight Controls Technology 

D. J. Maund 

Flight Controls Technology 

C. W. Erickson 

Integrated Electronic Systems Technology 



R. D. Force 

C. W. Lee 

D. G. Moss 
R. L. Norton 
K. C. Chan 
K.A.B. Macdonald 


Integrated Electronic Systems Technology 
Integrated Electronic Systems Technology 
Integrated Electronic Systems Technology 
Integrated Electronic Systems Technology 
Product Assurance 
Product Assurance 


During this study, principal measurements were made in U.S. customary units and were 
converted to Standard International units for this document. 

Use of trade names or names of manufacturers in this report does not constitute an 
official endorsement of such products or manufacturers, either expressed or implied, by 
the National Aeronautics and Space Administration. 
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1.0 SUMMARY 


This report documents the ACT/Control/Guidance System portion of the Integrated 
Application of Active Controls (IAAC) Technology to an Advanced Subsonic Transport 
Project, a part of the NASA Energy Efficient Transport (EET) Program. There were two 
major subtasks: (1) Functional Analysis and (2) System and Simulation Definition 

Requirements. 

The objectives of the Functional Analysis subtask were to: 

• Define the air traffic environment of the 1990s with respect to (1) the probable 
airborne system complement of a commercial transport operating in that era and (2) 
the possible effects on operations of an airplane with active controls 

• Assess the airplane systems technology level expected by the 1990s 

• Identify the Active Controls Technology (ACT) airplane flight functions in a top-down 
listing, together with the criticality to safety of flight associated with the ACT- 
related and control/guidance functions 

The objectives of the System and Simulation Definition Requirements subtask were to: 

• Define an operational function structure for an integrated ACT avionics and flight 
deck system that would meet the operational requirements and functional objectives 
of the function analysis 

• Define the scope and requirements of a program for simulation of the integrated ACT 
avionics and flight deck system with pilot in the loop, in terms of simulation scenario, 
ACT avionics and crew system elements simulated, and the recommended 
mechanization 

It was determined that the ACT airplane considered in this study is compatible with 
current and anticipated air traffic control procedures. 



The state-of-the-art avionics and flight controls device technology available to mechanize 
the 1990 ACT airplane systems is expected to allow greater standardized modularization 
of subsystem elements together with decentralization of control software and reduction 
of software overhead, validation time, and maintenance burden. This expectation is 
contingent upon availability of data bus types with interface terminal characteristics such 
as those described for the Digital Autonomous Terminal Access Communication (DATAC) 
bus. 

The preliminary ACT/Control/Guidance System architecture resulted in four autonomous 
digital data buses carrying all system traffic exclusive of that dedicated to analog flight 
crucial Essential Pitch-Augmented Stability. The analog control availability of that 
function was treated separately. Integration of the functions of sensors, actuators, 
conventional "avionics," and flight deck controls and displays was accomplished by four 
main interactive processor groups and by one other autonomous processor group dedicated 
to flight crucial function processing. 

The system architecture remains to be analyzed, verified, and discussed with potential 
users (the airlines). This should include a thorough analysis of system performance and a 
piloted simulation to evaluate crew use of the selected system. 

The simulation requirements are presented, framed within a detailed scenario of crew 
flight tasks during each phase of flight, and are in accordance with the ACT avionics and 
flight deck elements and functions requiring mechanization. 



2.0 INTRODUCTION 


The Integrated Application of Active Controls (IAAC) Technology to an Advanced 
Subsonic Transport Project has three major objectives: (1) the credible assessment of the 
benefit to a commercial jet transport airplane of the full application of active controls 
designed into the airplane from the beginning of the airplane program, (2) identification of 
the risks associated with the use of Active Controls Technology (ACT), and (3) reduction 
of these risks to a level commensurate with commercial practice through test and 
evaluation. 

This project, a part of the NASA-Boeing Energy Efficient Transport (EET) Program, has 
been organized into three major elements as shown at the top of Figure 1. The first major 
element included establishment of the design criteria appropriate for an ACT airplane, 
design of an ACT airplane configuration to meet the selected criteria, design of an ACT 
control system based upon current technology, and selection and evaluation of a Final 
ACT Configuration. In parallel with these tasks, the Advanced Technology ACT Control 
System element included exploration of more direct control law synthesis methods, 
alternative means of implementing the ACT functions using advanced technology, and the 
integration study of this report (shown shaded in the figure). The final major element of 
the IAAC Project will address reduction of risk, associated with implementation of ACT 
on a commercial transport, through test and evaluation activities. Reference 1 contains a 
more detailed discussion of the IAAC Project Plan. 

The ACT/Control/Guidance System task was undertaken to understand the relationship of 
the ACT systems to the control and navigation and guidance systems, leading to 
appropriate functional integration of those systems within the advanced technology and 
operating environment of the 1990s, and thereafter to define requirements for simulation 
of the integrated systems with pilot in the loop. 

The first part of the report discusses expected operational air traffic control environment 
of the 1990s (sec 4.0), technology expected of that era as it affects ACT airplane system 
implementation (sec 5.0), and definition of system function types and their criticalities, 
which influence integration of crew tasks with ACT/Control/Guidance System functions 
(sec 6.0). Section 7.0 presents a definition and analysis of a top-down structured system 
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Figure 1. Advanced Technology ACT Control System Definition Element 

of integrated active controls, avionics functions, and crew interfaces for a 1990s ACT 
airplane. Section 8.0 presents the simulation requirements for the necessary 
pilot-in-the-loop evaluation of the ACT/Control/Guidance System. 

This document (vols. I and II) is the complete report on that task work. Volume II contains 
appendices to the material in Volume I. 
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3.0 SYMBOLS AND ABBREVIATIONS 


This section contains three subsections: General Abbreviations, Subscripts Related to 

Velocity V or Mach Number M, and Symbols. Each subsection is arranged in alphabetical 
order. 


3.1 GENERAL ABBREVIATIONS 






ac 

alternating current 

alt 

altitude 

app. 

appendix 

AAL 

angle-of-attack limiting 

AAS 

aircrew alert system 

ACARS 

ARINC communication addressing and reporting system 

ACP 

autoflight control panel 

ACT 

Active Controls Technology 

AD 

airspeed display 

A/D 

analog to digital 

ADC 

analog-to-digital converter 

ADD 

attitude director display 

ADF 

automatic direction finder 

ADP 

air data processor 

ADS 

air data sensor 

ADSEL 

address beacon surveillance system 

AERA 

automatic en route ATC 

AFCS 

automatic flight control system 

AGL 

above ground level 

AHRS 

attitude heading reference system 

AIDS 

airborne integrated data system 

AIM 

acknowledgment, ISO alphabet No. 5, and maintenance 

ALCM 

air-launched cruise missile 

ALPG 

autoland processor group 

ALU 

arithmetic logic unit 

AOA 

angle of attack 

AP 

attitude processor 
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APL 

APU 

AR 

ARINC 

ARSR 

ARTCC 

ARTS 

ASCII 

ASDE 

ASR 

A/T 

ATARS 

ATC 

ATCRBS 

ATDP 

ATIS 

bps 

B 

BCAC 

BCAS 

BCD 

BITE 

BMS 

cd 

eg 

com 

C 

CAD 

CAS 

CAT I, II, 

CCD 

CCW 

CCZ 

CDMA 

CDTI 


Applied Physics Laboratory 
auxiliary power unit 
antireflection 

Aeronautical Radio Incorporated 

air route surveillance radar 

Air Route Traffic Control Center 

automated radar terminal system 

American standard code for information interchange 

airport surface detection equipment 

airport surveillance radar 

autothrottle 

automatic traffic advisory and resolution service 
air traffic control 

air traffic control radar beacon system (ICAO term: SSR) 

air-turbine-driven pump 

automatic terminal information service 

bits per second 

blue 

Boeing Commercial Airplane Company 

beacon collision avoidance system 

binary-coded decimal 

built-in test equipment 

body motion sensor 

candela 

center of gravity 

communications 

Celsius 

computer-aided design 
computed airspeed 
III ILS landing minimums 
charge-coupled device 
counterclockwise 
coastal confluence zone 
code-division multiple access 
cockpit display of traffic information 
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CDU 

CML 

CMOS 

CNSP 

CPU 

CR 

CRT 

CSD 

CSMA 

CSPD 

CW 

CWS 

CY 

dB 

dc 

DABS 

DATAC 

DCTTL 

DH 

DIGIVUE 

DITS 

D/L 

DMA 

DME 

DMOS 

DOD 

DOT 

DPG 

DRO 

EAC 

EADI 

EAROM 

ECL 

ED 

EDP 


control display unit 

complementary merged logic 

complementary metal-oxide semiconductor 

communication and navigation status panel 

central processing unit 

contrast ratio 

cathode-ray tube 

constant speed drive 

carrier-sense multiple access 

control surface position display 

clockwise 

control wheel steering 
calendar year 
decibel 

direct current 

discrete address beacon system (see Mode-S) 

Digital Autonomous Terminal Access Communication (System) 
diode-coupled transistor-transistor logic 
decision height 
trade name 

Digital Information Transfer System 
data link 

direct memory access 

distance measuring equipment 

dielectrically isolated metal-oxide semiconductor 

Department of Defense 

Department of Transportation 

dedicated pitch gyro 

destructive readout 

expected approach clearance 

electronic attitude director indicator 

electrically alterable read-only memory 

emitter-coupled logic 

engine display 

engine-driven pump 
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EET 

EFL 

EGT 

EH 

EHSI 

E-JFET 

EL 

EMA 

EPR 

EPROM 

ES 

ETA 

fc 

f ig- 

fj 

fL 

4-D 

F 

FAA 

FAD 

FAPG 

FAR 

FDD 

FDM 

FDMA 

FE 

FEA 

FEPG 

FET 

FGPG 

FID 

FLIR 

FMC 

FMPG 

FS 


Energy Efficient Transport (Program) 
emitter-follower logic 
exhaust gas temperature 
electrohydraulic 

electronic horizontal situation indicator 
enhanced junction field-effect transistor 
electroluminescence 
electromechanical actuator 
engine pressure ratio 

eraseable, programmable read-only memory 

engine sensor 

estimated time of arrival 

footcandle 

figure 

femtojoule 

footlambert 

four-dimensional navigation 
Fahrenheit 

Federal Aviation Administration 
fuel advisory departure 
flight augmentation processor group 
Federal Aviation Regulation 
flight deck display 
frequency-division multiplexing 
frequency-division multiple access 
flight engineer 

Federal Energy Administration 
flight essential processor group 
field-effect transistor 
flight guidance processor group 
flight instrument display 
forward-looking infrared 
flutter-mode control 
flight management processor group 
fuel sensor 
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g 

G 

GaAs 

GHz 

GLA 

GMT 

GPS 

GPWS 

GS 

G/S 

h 

hp 

HDD 

HF 

HHUD 

HMOS 

HOL 

HSD 

HSI 

HUD 

inHg 

IAAC 


IAP 

ICAO 

IEEE 

IFR 

l2L 

ILS 

IMC 

INS 

I/O 

IR 

IRS 

ISA 


acceleration due to gravity 
billion; green 
gallium arsenide 
gigahertz 

gust-load alleviation 
Greenwich mean time 

global positioning system (formerly NAVSTAR) 

ground proximity warning system 

glide slope 

ground speed 

altitude 

horsepower 

head-down display 

high frequency 

holographic head-up display 

high-performance metal-oxide semiconductor 

higher order language 

horizontal situation display 

horizontal situation indicator 

head-up display 

conventional inch of mercury 

Integrated Application of Active Controls Technology to an Advanced 
Subsonic Transport Project 

integrated actuator package 

International Civil Aviation Organization 

Institute of Electrical and Electronic Engineers 

instrument flight rule 

integrated injection logic 

instrument landing system 

instrument meteorological condition 

inertial navigation system 

input/output 

infrared 

inertial reference system 
ICAO standard atmosphere 
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ISL 

ISO 

JFET 

kHz 

kn 

kPa 

kV 

kW 

K 

KCAS 

KEAS 

lb/in2 

lm/W 

Loran-C 

lx 

L 

LAS 

LC 

LE 

LED 

LOC 

LRU 

LSI 

LSIC 

LSTTL 

mbar 

mil 

min 

Mode-S 

ms 

mW 

pm 

ps 

pW 

M 


injection Schottky logic 
International Standards Organization 
junction field-effect transistor 
kilohertz 
knot 

kilopascal 

kilovolt 

kilowatt 

thousand 

knots calibrated airspeed 
knots equivalent airspeed 
pounds per square inch 
lumen per watt 
long-range navigation, type C 
lux 

length 

lateral/directional-augmented stability 

liquid crystal 

leading edge 

light-emitting diode 

localizer 

line replaceable unit 

large-scale integration 

large-scale integrated circuit 

low-power Schottky transistor-transistor logic 

millibar 

mil 

minute 

new ICAO-standard selective-address ATCRBS mode (see DABS) 

millisecond 

milliwatt 

micrometer 

microsecond 

microwatt 

Mach; million 


.O 
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MAC 

mean aerodynamic chord 

MB 

marker beacon 

MESFET 

metal semiconductor field-effect transistor 

MFD 

multifunction display 

MFK 

multifunction keyboard 

MFP 

multifunction panel 

MHz 

megahertz 

MIL-STD 

military standard 

MLC 

maneuver-load control 

MLS 

microwave landing system 

MLW 

maximum landing weight 

MNOS 

metal-nitride-oxide semiconductor 

MOS 

metal-oxide semiconductor 

MOSFET 

metal-oxide semiconductor field-effect transistor 

MPa 

megapascal 

M&S 

metering and spacing 

MSAW 

minimum safe altitude warning 

MSL 

mean sea level 

MSPP 

mechanical servo power package 

MTBF 

mean time between failures 

MTOGW 

maximum takeoff gross weight 

MZFW 

maximum zero fuel weight 

nm 

nanometer 

nmi 

nautical mile 

npn 

negative-positive-negative 

ns 

nanosecond 

N1 

low-speed compressor RPM 

N2 

high-speed compressor RPM 

N/A 

not available 

NAS 

National Airspace System 

NAV 

navigation 

NAVSTAR 

(see GPS) 

ND 

navigation display 

NDB 

nondirectional beacon 

NDRO 

nondestructive readout 
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NMOS 

NV 

Omega 

O 

OEW 

p3 

pnp 

ps 

PA 

PAR 

PAS 

PBT 

PDME 

PFC 

PMOS 

PROM 

PS 

PTA 

q 

rad 

ref 

r/min 

rms 

R 

RALT 

RAM 

RC 

RCA 

RFI 

RMD 

RMI 

RNAV 

ROM 

RPM 

RVR 


negative metal-oxide semiconductor 
not volatile 

very-low-frequency navigation system 
orange 

operating empty weight 
picojoule 

positive-negative-positive 

picosecond 

public address 

precision approach radar 

pitch-augmented stability 

permeable-base transistor 

precision distance measuring equipment 

pilot flight control 

positive metal-oxide semiconductor 

programmable read-only memory 

pneumatic sensor 

planned time of arrival 

body pitch rate 

radian 

reference 

revolutions per minute 
root mean square 
red 

radio altimeter 
random-access memory 
resistance times capacitance 
company name 
radiofrequency interference 
radio magnetic display 
radio magnetic indicator 
area navigation 
read-only memory 
revolutions per minute 
runway visual range 
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RW 

runway 

RZ 

return to zero 

s 

second (same as sec) 

sec 

second (same as s) 

SD 

system display 

SDFL 

Schottky diode FET logic 

SELCAL 

selective calling 

Si 

silicon 

SID 

standard instrument departure 

SOCMOS 

selective-oxidation CMOS 

SOISMOS 

silicon on insulated substrate MOS 

SOS 

silicon on sapphire 

SPS 

surface position sensor 

SRAM 

short-range attack missile 

SSB 

single sideband 

SSD 

system status display 

SSR 

secondary surveillance radar (U.S. term: ATCRBS) 

STAR 

standard terminal arrival route 

STTL 

Schottky transistor-transistor logic 

SX 

longitudinal distance from runway threshold (positive forward) 

SY 

lateral offset from runway centerline (positive right) 

TACAN 

tactical air navigation 

TBD 

to be determined 

TCAS 

Traffic Alert and Collision Avoidance System 

TCD 

time-critical display 

TDM 

time-division multiplexing 

TDMA 

time-division multiple access 

t d 

propagation delay 

TE 

trailing edge 

TED 

transfer electronic device 

TFEL 

thin-film electroluminescence 

TFT 

thin-film technology 

T-NAV 

four-dimensional navigation (see 4-D) 

TOD 

top of descent 

TOLD 

takeoff and landing data 
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TR 

TSO 

T T 

TTL 

TV 

u 

UHF 

UV 

vol. 

V 

VAC 

VASI 

VAX 

V C 

VFR 

VHF 

VHSIC 

VLF 

VMC 

VMOS 

VOR 

VORTAC 

VSD 

V T 

W 

WLA 

WMS 

Wshld 

XPOND 

Y 
z 

ZnS 

ZnS:Cu 

ZnS:Mn 


transformer-rectifier 
technical standard order 
total air temperature 
transistor-transistor logic 
television 

incremental value of forward velocity 

ultra high frequency 

ultraviolet 

volume 

volt; volatile 

voice-activated control 

visual approach slope indicator 

vertical address extended (computer) 

airspeed 

visual flight rule 

very high frequency 

very-high-speed integrated circuit 

very low frequency 

visual meteorological condition 

V-groove metal-oxide semiconductor 

very-high-frequency omnidirectional range 

combined VOR and TACAN 

vertical situation display 

true airspeed 

watt 

wing-load alleviation 
wing motion sensor 
windshield 
transponder 
yellow 

body normal acceleration 
zinc sulfide 

copper-activated zinc sulfide 
manganese-activated zinc sulfide 
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3.2 SUBSCRIPTS RELATED TO VELOCITY V OR 
MACH NUMBER M 


dive 

equivalent airspeed 
liftoff 

maximum operating 
reference speed 
stall 

"go speed," committed on takeoff 

1.1 times minimum controllable speed with engine out 
or 1.2 times stall speed 

3.3 SYMBOLS 


flightpath angle 

change in quantity 

control deflection angle 

micro 

sigma 

bank angle 

yaw attitude 
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4.0 ACT AIRPLANE ATC OPERATIONAL ENVIRONMENT OF THE 1990s 


This section describes the expected air traffic control (ATC) environment of the 1990s in 
which the Active Controls Technology (ACT) airplane will operate and defines the 
avionics equipment and operational capabilities required on board the airplane to 
interface with the environment. This description is based on current industry and Federal 
Aviation Administration (FAA) projections and assumptions. 

Further, the effect of ACT air traffic control clearances on airplane flight functions and 
avionics configuration is defined. This was done by comparing relevant characteristics of 
the Conventional Baseline and Initial ACT Configuration airplane designs to determine 
which operating characteristics are ATC sensitive. 

4.1 ATC GROUND SYSTEM EFFECTS ON AIRBORNE SYSTEM EQUIPMENT 

The description of the 1990s ATC system was developed using information from many 
sources, which described the present system elements, new elements under development, 
and elements being researched that appear to offer promise as eventual system elements. 
Supplemental material came from Department of Transportation (DOT) informal industry- 
review drafts of that agency's extrapolations of the National Airspace System for the 
1985, 1990, and 1995 time periods. Reference 2, the FAAs National Airspace System 
Plan— Facilities, Equipment and Associated Development, which addresses the FAA plan 
for upgrading the ATC system during the next two decades, was used to establish currency 
of the 1990s system implementation forecast. 

The FAA considered the following factors in making its ATC projection: 

• The current FAA major system development program 

• The current FAA advanced system development program and its projected output 

• The FAA new engineering and development initiatives effort that represents user 
views with respect to operational philosophy and technology choices for the future 

o The best available assessment of the evolution of aircraft and aircraft systems 
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• Assessment of the shortcomings of present and anticipated systems 


• The views of system developers and operators based on their judgment and experience 

• Evaluation of available technology and its impact on new hardware and software 
enhancements and replacements 

• Evaluation of the driving forces that will shape the environment, including traffic 
growth, traffic mix, energy constraints, and budget constraints 

The expected traffic demand is key to projecting the nature of the 1990s ATC system. 

The FAA assumed a traffic forecast with the following characteristics: 

• Air carrier instrument flight rule (IFR) operations growth will average 1.9% per year 
through the coming decade. 

• General aviation IFR growth will average 6% per year, and general aviation aircraft 
and hours flown will nearly double in the next two decades. 

• Air taxi (including commuter) IFR growth will average 7.4% per year. 

• Military IFR growth will remain constant. 

• Demand on FAA Air Route Traffic Control Centers (ARTCC) will increase at just over 
3% per year and therefore will experience a 50% increase in activity by 1991. 

• Peak demand levels will become more severe. 

• The traffic mix will become more heterogeneous. 

• Airport congestion will create ATC backups into the en route airspace. 

• The number of helicopters and helicopter operators will continue to grow at a high 
rate. City-center to city-center operations are expected to be commonplace by the 
end of the 1990s. 





The following subsections describe the 1990s ATC system in three parts: (1) those 

electronic system elements that play a direct role in controlling aircraft, (2) the 
automation computer programs that will provide the controller with increased capability 
beyond what can be done without computer assistance, and (3) the levels of ATC service 
that may be expected in differently defined airspace resulting from variations in traffic 
density and types of aircraft operations. Figure 2 summarizes the projected ATC 
environment for the 1990s. 
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ATC subTystenT ^1980 1985 1990 1995 200 0 

• Navigation 

• Basic VOR, DME, NDB 

• Alternate or special application 

• Loran-C = = = == = = = := = = = :: = = = = 
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• MLS t= - -1 ^= 1. ■— -=— 

• Communications 

• Mode-S data link I " = — ' 

• Very high frequency ■■■■ ■■■■ 
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• Separation assurance 

• TCAS ■ -■ 

• Data acquisition 
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• Mode-S * ~~ ~ — ~ = 
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Development 
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Figure 2 . U.S. Air Traffic Control Environment in the 1990s 


4.1.1 SYSTEM ELEMENTS 


The ATC system provides air traffic services, aeronautical mobile communications, 
aeronautical navigation services, and landing aids. Data acquisition and separation 
assurance systems augment and/or back up these air traffic services. 
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4. 1.1.1 Data Acquisition 


The present International Civil Aviation Organization (ICAO) standard system for 
providing data for en route and terminal area ATC is the air traffic control radar beacon 
system (ATCRBS). It is a secondary radar system (an interrogator-transponder system), in 
which a transponder carried on the airplane provides flight identity information (and 
altitude if an altitude encoder is carried) in response to ground-based discrete 
interrogation. The interrogator also determines airplane position (range and azimuth 
relative to the interrogator location). 

ATCRBS performance degrades in areas of high traffic density, and the FAA is developing 
a new beacon mode that will overcome much of the ATCRBS problems by selectively 
interrogating or addressing each flight. This new mode, called Mode-S, is fully compatible 
with the ATCRBS and is intended initially for use in high-density airspace. Mode-S can 
also function as a two-way digital data link between ATC and the airplane. Mode-S is 
expected to have an initial operating capability in 1986-87, and by the 1990s will be the 
primary data acquisition system for both high-density terminal areas and en route sectors. 
The United Kingdom has developed a similar selective address beacon surveillance system 
(ADSEL), which is intended to be completely compatible with Mode-S. It is expected that 
ICAO will eventually standardize on an ATCRBS-compatible Mode-S system in the 
international system for ATC data acquisition. The Mode-A and Mode-C ATCRBSs will 
continue to be used in U.S. low-density airspace for some time because of the cost of 
replacing all Mode-A and Mode-C interrogators with Mode-S interrogators. Elsewhere, 
Mode-A and Mode-C ATCRBSs may be used until well into the' next century, although the 
Mode-S system may be used in the more developed areas. 

The Mode-S surveillance system requires a special Mode-S transponder on the airplane to 
allow selective addressing and to provide data link service. An ATCRBS-transponder- 
equipped airplane will receive service in Mode-S airspace; however, Mode-S transponders 
will eventually be required because of potential problems. Conversely, Mode-S 
transponders function as ATCRBS transponders in ATCRBS airspace. 

Surveillance coverage (using Mode-S) will be provided at 1830m (6000-ft) mean sea level 
(MSL) and above and during approaches to qualifying airports. The surveillance system 
comprises en route and terminal radar and beacon systems. By 1990, Mode-S and data link 
coverage will be provided above 3810m (12 500-ft) MSL to designated airports. By the 
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year 2000, data link coverage will be extended from 3810m (12 500-ft) MSL down to 
1830m (6000-ft) MSL. Primary radar will be retained for FAA weather and ATC 
requirements until the 1990s. Primary en route radar will be gradually replaced by the 
next-generation weather radar and finally eliminated by the year 2000. 

The concept of cockpit display of traffic information (CDTI) is being examined as a means 
of allowing the pilot to control his own flightpath in response to limited ATC clearances 
such as "maintain 8 km (4.3 nmi) in-trail behind flight XXXX." If such a system were to 
be developed, the airplane would require special communications, data processing, and 
control and display equipment and could require changing the flight deck to resolve 
workload problems. 

Airport surface detection equipment (ASDE) is a primary radar system that gives the 
controller a pictorial presentation of the airport surface area and the relative position of 
the aircraft on that surface. The system aids the efficient and expedient movement of 
aircraft on the airport surface, thus promoting safety and improved operations rates. 
Currently, ASDE-2 is the only data acquisition system in use for airport ground 
surveillance. After 1989, the solid-state ASDE-3 will replace all ASDE-2 installations. 

4. 1.1. 2 Separation Assurance 

A system under development, Traffic Alert and Collision Avoidance System (TCAS), is 
designed to provide independent, backup separation assurance to air traffic control. 

TCAS-I and TCAS-II operate independently of the ground. The basic unit, common to both 
systems, is an integral transponder capable of operating on Mode-A, Mode-C, and 
Mode-S* (with surveillance, COMM-A, COMM-B, and COMM-C message format 
capabilities). 


*Mode-A, Mode-C, and Mode-S comprise the basic discrete address beacon system (DABS) 
ICAO transponder capability. Mode-A alone is the basic civil and military mode for ATC 
use. Mode-C refers to the addition of altitude information. Mode-S refers to the new 
selective address capability of DABS. Non-DABS (or non-Mode-S) beacons have either a 
Mode-A or Mode-A plus Mode-C capability. The term "DABS" has been dropped from the 
FAA lexicon. 
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TCAS-I is the simpler of the two systems and is intended primarily for general aviation 
aircraft. It should be able to receive (from TCAS-II equipped aircraft) and display (1) 
traffic advisory information (range, relative azimuth that can be converted to a relative 
bearing, relative bearing that is independent of relative azimuth when available, and 
differential altitude) and (2) nearest approach prediction of the intruder TCAS-II aircraft. 
TCAS-I, as yet undefined, would receive and display (1) sensitivity-dependent, non- 
altitude-filtered range information from Mode-A and Mode-C and from Mode-A 
transponders within ATCRBS or secondary surveillance radar (SSR) using Mode-A, 
Mode-C, and Mode-S ground station coverage and (2) altitude-filtered range information 
from Mode-S squitter transmission generated by other TCAS-I and Mode-A, Mode-C, and 
Mode-S transponders in all airspace. TCAS-I sensitivity would be controlled manually. 

Growth capability includes the ability to (1) altitude-sort sensitivity-dependent 
information on ATCRBS Mode-A and Mode-C transponder-equipped aircraft within the 
ATCRBS or Mode-A, Mode-C, and Mode-S ground station coverage and (2) provide simple 
o'clock position of threat display, based on use of a simple directional antenna. 

TCAS-II equipment is intended for air carrier application. It consists of a basic Mode-A, 
Mode-C, and Mode-S transponder; a collision avoidance interrogator; collision avoidance 
logic and data processor; and appropriate controls, displays, and antennas. TCAS-II will 
provide collision avoidance protection independently of the ground ATC system, using 
vertical avoidance maneuvers (TCAS-I does not provide collision avoidance commands). 

The TCAS-II collision avoidance operation is similar to the operation of the active beacon 
collision avoidance system (BCAS) with the added capability of directional sensing. 
TCAS-II will function through transponder replies it receives from aircraft and will use 
these inputs to calculate range, relative altitude, and closing information in relation to 
the aircraft that are possible collision threats. When a "projected time to collision" is 
about 30 sec, TCAS-II will indicate recommended avoidance maneuvers (vertical) on the 
TCAS display on the subject aircraft. The azimuth sensing capability will be used for 
horizontal miss distance assessment and the generation of horizontal resolution advisories. 
The directional antenna also provides solutions to the problems of synchronous garble, 
which can occur when several aircraft are interrogated simultaneously. This is 
accomplished by limiting or rationing the interrogation energy to those directions where it 
is most needed. 



TCAS-II can transmit traffic advisory information (range, relative azimuth, relative 
bearing, differential altitude, and information on any maneuver being executed) to other 
TCAS-I and TCAS-II equipped aircraft. 

TCAS-II will have an integral scanning antenna system (or equivalent) with direction- 
finding accuracy sufficient to present an o’clock display (+8 deg, la) centered on the 
TCAS-II aircraft. It will also have sufficient accuracy to transmit north-reference 
relative azimuth advisory information to TCAS-I and TCAS-II equipped aircraft with an 
accuracy of +9 deg, la. 

The TCAS-II aircraft display will be altitude filtered for Mode-C equipped targets and will 
warn of threatening aircraft within designated display ranges on a display of the user’s 
choice. 

A TCAS-II sensitivity adjustment, independent of the ground ATC system, will be 
provided. 

4. 1.1.3 Communications 

The very-high-frequency (VHF) voice system will remain the basis for continental United 
States ATC ground-air communications. Voice communication coverage to towers, ATC 
centers, and flight control stations will be provided at or higher than 600m (2000 ft) above 
ground level. Existing and future radiofrequency requirements will make conversion of 
ground and airborne systems to 25-kHz spacing necessary. Military aircraft will use ultra 
high frequency (UHF). Beginning with selected routine messages, the Mode-S data link, 
where available, will gradually assume the load for most normal ATC air-ground 
communications. Initially, the Mode-S data link is being considered for takeoff-clearance 
and altitude assignment confirmations, minimum safe altitude warning (MSAW) advisories, 
and various weather data. Planned future messages include enhanced en route weather, 
downlink weather data, ATC instructions, metering and spacing (M&S) instructions, 
hazardous precipitation, flight plan filing, clearance delivery, and Category I and II 
protection status. The Mode-S data link is a candidate means of uplinking data for the 
CDTI, and eventually all ATC clearances may be provided by the Mode-S data link. 

Avionics required for Mode-S data link operation, in addition to the Mode-S transponder, 
will include data link interface electronics, message input device, and message display 
equipment. 



The Mode-S data link will be mandatory only in designated airspace. VHF voice will 
continue to provide service to the user without data link, for nonroutine communications 
to data link users, and in airspace not covered by Mode-S surveillance. 

Over most oceanic areas and certain ground areas not equipped with the VHF system, 
long-range ground-air ATC communications will be accomplished by the high-frequency 
(HF) communication system. This system may be supplemented by a satellite 
communication system when that technology becomes more cost effective. 

4. 1.1. 4 Navigation Aids 

The very-high-frequency omnidirectional range (VOR) is the ICAO standard short-range 
navigation aid. VOR provides a magnetic bearing from the airplane to the VOR ground 
station. It is protected by international agreement to 1985, and the protection is 
expected to be extended. The FAA is upgrading U.S. VOR facilities, indicating expected 
use as the standard U.S. navigation aid into the 1990s. The nation's count of 884 VOR 
(VOR-DME and/or VORTAC) facilities will grow to 960 facilities by 1999. 

Distance measuring equipment (DME) measures distance from a DME ground station and is 
the ICAO standard short-range navigation aid that provides for more precise navigation 
than VOR alone. These two aids (VOR and DME) are generally colocated for most 
efficient use. ICAO plans no changes in its DME standards before 1985. DME is the 
distance part of the U.S. Department of Defense (DOD) standard short-range tactical air 
navigation (TACAN) system. Thus, VOR and DME will be the standard navigation aids for 
the United States in the 1990s. 

In addition to VOR and DME, some nondirectional beacons (NDB) will be used; NDB 
systems are nondirectional radio transmitting stations. Aircraft equipped with automatic 
direction finders (ADF) receive signals to obtain a bearing relative to vehicle heading. 
Beacons transmit in radiofrequency bands of between 200 to 415 kHz over ranges from 18 
to 650 km (10 to 350 nmi), depending on location, operational objective, and power. 
Bearing accuracy is about +3 deg. 

NDBs are used during the transition from en route to airport precision approach facilities 
and as a nonprecision approach aid at many smaller airports. NDBs also provide radio aid 
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for flight navigation where VOR coverage is not available. In Alaska they are an integral 
part of low-altitude airway structure. The beacons may also relay transcribed weather 
broadcasts. 

The FAA operates 215 NDBs. In addition, there are about 500 nonfederally operated 
aeronautical beacons. During the next 10 years, FAA beacon expenditures are planned to 
be limited to the occasional relocation or establishment of an NDB for instrument landing 
system (ILS) transition, replacement of deteriorated components, and modernization of 
selected facilities, thereby increasing the number of FAA-operated NDBs to 263 by 1999. 

Several other navigation aids may be used for special applications. These aids include the 
Omega very-low-frequency system, the satellite-based global positioning system 
(NAVSTAR), and Loran-C. The global positioning system (GPS) is being considered as a 
possible successor to VOR and DME. In addition, an inertial navigation system (INS), 
probably in combination with a navigation aid, will be certified for area navigation. 

Omega— Omega is a VLF long-range navigation system being implemented by the U.S. 
Navy. In addition to DOD air and marine users, commercial and private ships are using 
the Omega system. Certain intercontinental air carriers are using Omega to bound the 
errors of their self-contained navigation systems and also as a standalone navigation 
system. 

GPS (NAVSTAR)— GPS is being developed by the DOD and is intended to provide 
positioning primarily for weapon delivering systems, as well as a number of other military 
missions. It will use satellites to provide worldwide, continuous, real-time, all-weather 
precision information to users operating equipment in a passive mode. 

The FAA and NASA are investigating GPS for potential application in the civil sector. If 
implemented, the degree of its acceptance for civil use will be especially sensitive to the 
successful design of low-cost user equipment. The use of GPS by the international civil 
community raises institutional questions on system management that need further 
examination. While present design predictions indicate that GPS for civil use is not 
expected to be accurate enough to replace precision landing systems, it may have a 
technical potential for nonprecision approaches to any airport in the world. 



Loran-C-The Loran-C is a pulsed, hyperbolic navigation system operating on 100 kHz. 
Groundwave range is typically 1100 to 2600 km (600 to 1400 nmi) over seawater. 
Predictable accuracy of position information is at least 0.46 km (0.25 nmi) 
(2a root mean square) in advertised groundwave coverage areas when using automatic 
receivers of current design. The repeatable accuracy of the system is 18m to 90m (60 to 
300 ft). With the exception of one station operated by the Government of Canada, the 
stations providing coverage for the United States are operated by the U. S. Coast Guard. 

In 1974, Loran-C was designated as the U.S. Government-provided navigation system for 
the coastal confluence zone (CCZ). The implementation plan provides complete Loran-C 
operational coverage for the CCZ of the contiguous 48 states and southern Alaska. 

Because Loran-C stations must be land based and have a useful range of about 1850 km 
(1000 nmi), it is not feasible to provide a worldwide system using this technique. This 
coverage is fixed by the area where an adequate signal-to-noise ratio is available, as the 
system is noise limited. 

Loran-C navigation is not currently being installed by scheduled air carriers, and future 
use is unlikely because it cannot provide worldwide coverage for long-range navigation 
and is unlikely to be selected by ICAO for short-range navigation. 

4. 1.1. 5 Landing Aids 

Precision instrument approaches are presently based on the ILS. The ILS is protected by 
international agreement through the ICAO as the standard precision approach aid through 
1995. A new precision approach aid called the microwave landing system (MLS) has been 
approved by the ICAO and is expected to be colocated initially with ILS and to replace it 
eventually. 

Instrument Landing System— ILS ground equipment consists of a localizer facility, a glide 
slope facility, and two or three marker beacons. The localizer provides horizontal 
guidance about the runway centerline with extended coverage from at least 33 km (18 
nmi) to touchdown. The localizer signal emitted from the far end of the runway is 
adjusted to produce an angular width between 3 and 6 deg as necessary to provide a linear 
width of approximately 210m (700 ft) at the runway approach threshold. The localizer 



transmits in the 108- to 112-MHz band. The glide slope facility provides vertical guidance 
to an approaching aircraft. The glidepath angle is normally 3 deg above the horizontal. 
Marker beacons indicate to an approaching aircraft the distance to runway threshold. The 
glide slope device transmits in the 328- to 335-MHz band, and the beacons transmit at 75 
MHz. Most ILSs provide Category I landings with a decision height (DH) of 60m (200 ft) 
and a runway visual range (RVR) of 550m (1800 ft). Some systems have improved 
capabilities providing Category II, DH 30m (100 ft), RVR 400m (1200 ft); Category IIIA, 
DH 0, RVR 200m (700 ft); and Category IIIB, DH 0, RVR 50m (150 ft) landings. 

The FAA presently operates 752 full ILS facilities, each providing aircraft with vertical 
and horizontal guidance with respect to a particular airport runway. Additional facilities 
are operated by agencies other than the FAA. About 50 additional systems will be 
required by the ILS purchase cutoff date of 1983 to meet specific traffic requirements or 
to provide service at new airports. In addition, ILS facilities are operated by the DOD in 
the United States. 

ILS avionics equipment is required by Federal air regulation to be carried by most U.S. 
air carrier aircraft. It is used extensively by general aviation aircraft and is required for 
some IFR approach and landing operations. The equipment is also used extensively by 
aircraft of other countries, both air carrier and general aviation, because it is the ICAO 
landing aid standard. 

Terrain considerations are a factor in the installation of ILS (e.g., signal reflections 
(multipath) from the ground, taxiing aircraft, and other surface traffic). The single- 
approach path provided by an ILS constrains airport capacity and noise control. In regions 
where many airport runways require ILS, the saturation of current 100-kHz separated 
radiofrequency channels could be the limiting factor for the number of installations. 

Microwave Landing System— The MLS is a joint development of the DOT, DOD, and NASA 
under FAA management. Its purpose is to provide a civil and military, Federal and non- 
Federal standardized approach and landing system with improved performance and 
flexible implementation as compared with existing landing systems. 



Approach and landing navigation information is aircraft derived, based on 
ground-transmitted signals. Elevation and azimuth angle signals, combined with a 
precision distance measuring equipment (PDME) capacity, provide data over a wide 
volume (e.g., +40 deg in azimuth from runway centerline and 2 to 20 deg in elevation). 
The signal format lends itself to a variety of implementation forms ranging from simple 
and inexpensive to complex. The more complex systems enable landing under zero 
visibility conditions. 

After a period of coexistence, MLS is expected to replace the existing ILS. Currently, the 
ILS is protected by the ICAO through 1995. The FA A expects to start installing MLS 
facilities in 1983, with 15 systems in place by 1987. The installation rate will peak at 110 
per year in 1985 and will continue at that rate until all 1255 systems are in place. 


An airborne MLS consists of the MLS receiver and an antenna system that provides signal 
reception for all aspect angles expected to be used in the MLS. 


4. 1.1. 6 Aircraft Equipment 


Table 1 lists current equipment for air carrier navigation from point to point. Most of 
these items are cited as ICAO requirements for long-distance civil air navigation. These 
requirements normally reflect the demands of current operational environments. Table 1 
also lists applicable regulations. 


Table 1. Aircraft Navigation Equipment Currently Used in the 
Air Traffic Control Environment 


Navigation 

equipment 

Federal Aviation 

Regulation 

(FAR) 

Technical 

standard 

order 

(TSO) 

Advisory 

Circular 

Number 

required 

VOR 

121.349a, e 

C40a 

90-4 5 A 

2 

DME 

121.349c 

C66a 

90-45A 

1 

LOC/GS 

121.349a 

C34b 

1 20-28A 

1 



C36b 

120-29 

- 

MB 

121.349a 

C35c 

— 

1 

ADF 

121.349b 

C41b 

20-63 

1 

INS/ISS 

121.355 

— 

25-4 

2 


121, App. G 

— 

121-13 

— 

RNAV 

— 

— 

90-45A 

— 

Omega 

- 

- 

120-31 

- 
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Table 2 summarizes a typical airline navigation system and equipment list as published by 
the European Airlines Electronic Committee. (Although not shown here, altitude and 
heading systems are also an integral part of the navigation equipment complement.) 


Table 2. Typical Airline Navigation System and Equipment List 


Equipment 

Quantity 

AR INC documents 

VHF communications 

3 

716 

DME 

2 

709-1 

VOR 

2 

711-1 

LOC/GS 

2 

710-2 

Radio altimeter 

2 

707-1 

Marker 

1 

711-1 

Weather radar 

2 

708-1 

ADF 

2 

712-1 

INS/AH RS 

3 

704, 705 


Table 3 lists the equipment needed to interface electrically with the 1990s ATC system in 
all levels of airspace. 


Table 3. Avionics for Air Transport Operations in 1990s 
Air Traffic Control Environment 


System 

Application 

Avionics 

• Data acquisition 
• ATCRBS with 
Mode-S 

• Mode-S-equipped transponder required 
on air carrier aircraft 

• Mode-S transponder 

• Separation assurance 
• TCAS 

• Required for all air carriers 

• Interrogator, controls, and displays 

• Communications 

• VHF voice 

• Mode*S D/L 

• HFSSB 

• Most U.S. domestic and foreign ATC 
operations 

• High-density U.S. airspace 

• Overocean and lesser developed overland 
air routes 

• VHF transceiver 

• Mode-S data link modem and 
I/O devices 

• HF SSB transceiver 

• Navigation aids 

• VOR 

• DME 

• NDB 

• INS 

• Omega 

• GPS 

• Required for short-range navigation 

• Required for short-range navigation 

• Needed for navigation and approach 
guidance in some areas 

• Used for long-range navigation ^ 

independently or with other systems 

(e.g., for position fixing) 

• Used for long-range navigation 
independently or to position-fix INS 
in either VLF or Omega modes 

• May find use for either short- or long-range 

navigation or to position-fix INS j 

► 

• Receiver 

• Interrogator 

• Automatic direction finder 

One or more types needed for long-range 
navigation; INS installation must be at 
least a dual system 

• Landing aids 

• ILS 

• MLS 

• Required until 1995 or until all 
destination runways have MLS 

• Required after 1995 but needed before 
to obtain improved landing guidance 
available at runways where implemented 

• ILS localizer, glide slope, and marker 
beacon receivers 

• MLS receiver 
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4.1.2 CONTROL SYSTEM 


The control system is that portion of the ATC system that assesses the traffic situation 
and determines the actual route, altitude, and speed each flight is expected to use at any 
time to resolve the traffic situation. The objectives of this control process are safe 
separation of the flight from other aircraft, severe weather, and terrain; direct routing of 
the flight to its destination; and metering, sequencing, and spacing flights for landing. 

The present control system is essentially manual in that the situation assessment and 
decisions are accomplished by the controller. Automation programs are being developed 
to assist the controller in the control of traffic. Control at the highest level is evolving 
from today's manual radar-assisted system of control, based on the relative spacing 
between aircraft, toward an automated time-based system in which separation and 
spacing are inherent in the four-dimensional (4-D) flight schedule assigned to each 
aircraft. 

The control system of the 1990s will minimize global fuel usage by reducing airborne 
delay and using fuel-efficient flight profiles. Clearances based on two-, three-, and four- 
dimensional area navigation will be used extensively. To accomplish this, the system will 
use advanced ATC computer programs and airborne flight management system 
capabilities. 

The following paragraphs describe FAA programs that are presently in the research and 
development phase and concentrates on those programs expected to become part of the 
1990s integrated control system. 

A national integrated flow management system will match the en route traffic flow 
pattern to existing air route and airport capacity on a nationwide basis. By using data on 
the destination airport capacity expected at the time of arrival and the total traffic 
demand forecast at that time, the national integrated flow management system will allow 
all but a few minutes of the expected delay to be taken on the ground at the departure 
airport. This management system will be an improvement over the existing central flow 
control facility. Automation programs that are presently used and may become part of 
the national integrated flow management system include: 



• Fuel Advisory Departure (FAD) Procedures — These procedures are currently applied at 
Chicago and Denver. As implemented, the aircraft operator is offered the option of 
delaying his departure until ATC can absorb the flight with no more than about a 30- 
min arrival holding delay at destination. This concept reduces engine running time 
and fuel consumption while at the same time reduces the occupancy of the airspace 
in terminal areas during times of congestion or delay-causing weather phenomena. 

• Expanded Metering Program — Expanded metering is another FAA metering program 
(in effect at Denver). In expanded metering, when expected Denver delays are 
30 min or more and a nonstop flight originating within 75 min (flight time) of Denver 
is ready to depart, the flight is placed in the Denver metering list and a time to enter 
the Denver terminal area is calculated. The flight may take all but 10 min of the 
expected delay on the ground. It will then have only a 10-min airborne arrival holding 
delay. 

An integrated terminal area flow management system will be the basic means for 
controlling aircraft to achieve optimum airport throughput and optimum fuel performance 
of participating aircraft. En route and terminal area control will be integrated, and 
arrival metering will start during the en route portion of the flight. Wake vortex 
avoidance systems, airport configuration management aids, and airplane flight 
management system capabilities will be considered in developing the control clearances 
for metering flights into the terminal area. This impacts sequencing and spacing for 
landing. 

Automation programs that are being developed and can be expected to become part of the 
integrated terminal area flow management system include: 

• Metering and Spacing (M&S) — This system is designed to automate control in the 
terminal area. The first phase, basic M&S, is being developed to sequence and space 
arriving aircraft for landing. It will control arrival traffic using voice vectors and 
speed commands from the computer-generated controller. A subsequent 
development, advanced M&S, is expected to expand control to departures, missed 
approaches, etc., and provide control instructions directly to the pilot via a data link. 



Automatic En Route ATC (AERA) -An AERA-like program will be a primary element 
of the 1990s automatic ATC systems. AERA will automatically plan conflict-free, 
fuel-efficient flight trajectories for aircraft operating in positive control airspace. It 
will generate the ATC clearances needed to execute the planned profiles and ensure 
aircraft separation and to deliver these clearances via a Mode-S data link. AERA 
will self-protect against system failure by providing a coast capability and backup 
clearances and will be compatible with the independent backup separation assurance 
capabilities of TCAS. Aircraft carrying the Mode-S data link, area navigation 
equipment, and a flight management computer should be able to take full advantage 
of the AERA system. 


• En Route Metering -En route metering will control all en route traffic coming toward 
an airport to enable matching the flow rate into the terminal area to the runway 
acceptance rate. Functionally, it is automation of a procedure similar to the present 
Denver local flow management system. Each arrival is controlled from en route 
cruise through descent into the initial approach fix (called a metering fix) along a 
path that is both efficient from an aircraft flight standpoint and resolves air traffic 


conflicts. 



Based on an assigned landing time, a time is determined for each arrival to pass a 
metering fix and enter the terminal area so that it can nominally fly directly to the 
runway without delay. Control to meet the metering fix time is initiated during en 
route cruise using speed control and point-of-descent commands to absorb any delay 
with a minimum of holding. Eventually, the assignment of 4-D navigation (T-NAV) 
clearances to 4-D equipped arrivals en route to cruise altitude will allow these flights 
to meet the assigned metering fix time in the most fuel-efficient manner. Because 
the AERA program calculates long-term, conflict-free clearances for en route 
aircraft, an AERA-like program may be combined with en route metering to 
determine conflict-free 4-D arrival profiles. 


Automation programs that will assist the controller in providing safe separation include: 


• Minimum Safe Altitude Warning (MSAW) — MSAW is currently implemented as an 
automated radar terminal system (ARTS-III) terminal area function that 
automatically alerts the controller when a tracked Mode-C equipped aircraft is 
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below or is predicted by the ARTS-III computer to go below a predetermined 
minimum safe altitude. A similar en route function is being developed. 

• Conflict Alert and Resolution — Conflict alert projects the present flightpath of all 
aircraft ahead 2 min. System logic determines if separation between any pair will be 
lost and, if appropriate, alerts the controller to the pending situation. It is presently 
operational for en route airspace and is being implemented in ARTS-III terminal 
areas. Conflict resolution is being developed to provide solutions to the controller. 

These developments imply an airplane-ATC (pilot-controller) interface that relies upon a 
catalog of flexible, energy-efficient flight profiles compatible with saturated airspace 
containing various airplane types. This catalog is resident in both the airplane and ground 
computers and contains optimum standardization and flexibility to meet variable 
situations. 

4.1.3 LEVELS OF SERVICE 

The FAA is projecting several levels of ATC service for the forecast time period that 
range from highly automated control to no control service at all. Table 4 lists the ATC 
service levels for the 1990s. 

The first level of ATC service will relate to that airspace where all users are full 
participants and the highest level of ATC automation is required. This high-reliability 
automatic control system will provide reversion capability to a safe backup automatic 
control. The automated system will use the Mode-S data link system, which will provide 
information directly to the cockpit. A level of traffic awareness may be achieved by 
traffic cockpit displays that are fed from the Mode-S data link or the independent TCAS. 
Area navigation and the AERA system will be able to accommodate a large number of 
variables, which will allow a high degree of lateral and vertical routing freedom. Traffic 
information that may be made available in the cockpit includes moment-to-moment 
location and projects flightpaths of other aircraft. This can serve to increase the level of 
traffic awareness. New procedures will be required to ensure that pilot and controller 
actions are fully understood and coordinated. 



Table 4 . Levels of Service for Transport Aircraft in U.S. Airspace in 1990s 


Level of service 

Data 

acquisition 

Separation 

backup 

Communications 

Navigation 

aids 

Precision 
landing aids 

Control system 

Level 1 

• Positive 
control 
airspace 

• Mode-S 

• TCAS 

• Mode-S D/L 

• VHF voice 

•VOR/DME 

• IL 

• M 

.S 

LS 

• MSAW 

• En route metering 

• M&S 
•AERA 

• Conflict alert and 
resolution 

• Integrated flow 
management systems 

Level 2 

• Mixed 
IFR-VFR 
airspace 

• Mode-S 

• TCAS 

• Mode-S D/L 
and/or 
VHF voice 

• VOR/DME 



• MSAW 

• Conflict alert and 
resolution 

• Integrated flow 
management systems 

Level 3 

• Procedural 
airspace 

• None 
except 
incidental 
Mode-S 
coverage 

•TCAS 

• VHF voice 

• VOR/DME 

• Some NDB 


f 

• Manual insertion in 
flow management 
systems 

Level 4 

• Uncontrolled 
airspace 

• None 

• TCAS 

• None except 
incidental 
VHF voice 

• None except 
incidental 
VOR/DME 

• IL! 
ML 

.S 

• None 


The first level (and the following lesser levels of ATC service) are still primarily ground- 
based services based on knowledge of current aircraft position and intent. Ground control 
and flow management will remain important in en route airspace to ensure fuel-efficient 
flightpaths and to handle weather reroutes. Terminal and transition airspace analysis to 
optimize airport and fuel efficiencies is an important requirement. Of course, protection 
against collisions is a critical issue. 


The second level of service will be provided to low- and medium-density airspace to 
Mode-S equipped aircraft where mixed IFR and visual flight rule (VFR) operations occur. 
This service will provide efficient operations for ground-based separation assurance 
services and the airborne TCAS service. Routing freedom may be more limited than in 
the fully automated first-level environment. Cockpit-displayed traffic information may 
provide the capability for some self-separation on the part of the pilots; however, direct 
ground control services will be required in terminal areas. 
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The third level of service will resemble today's nonradar procedures. IFR operation will 
be under procedural rules. Depending upon the collision risk level to public transportation 
aircraft operating on IFR flight plans, aircraft will carry altitude-reporting Mode-S 
transponders so that TCAS or ATC centers can provide separation assurance. Self- 
separation may be common in this airspace for the instrument meteorological condition 
(IMC) to the extent that it can be achieved by using onboard or ground-based surveillance, 
a Mode-S data link, and a display of close-proximity traffic. 


In the fourth level of service, where no ground-based separation service is provided, 
airborne TCAS equipment may offer some protection in addition to "see and be seen." 


4.2 ATC PROCEDURE EFFECTS ON, OR ACCOMMODATIONS FOR, 

THE ACT AIRPLANE 

This study objective defines the operational environment by compiling and categorizing 
ATC clearances applicable to the ACT airplane time scale so that ACT-sensitive 
clearances can be identified and the effects on flight functions and avionic configurations 
defined. 

4.2.1 STUDY PROCEDURE 


The relevant characteristics of the Conventional Baseline and Initial ACT Configuration 
designs are compared to determine which operating characteristics are ACT sensitive. 
Comparisons are based on Reference 3 for the Conventional Baseline and on References 4 
through 7 for the Initial ACT Configuration design. 


An unpublished Boeing report that tabulates ATC clearances for present and future 
operational environments, which includes functional capabilities and postulated avionic 
system tasks dictated by clearances, was used as the ATC clearance data base for this 
study. That report was reviewed with the goal of identifying those clearances affected by 
the ACT-sensitive airplane operating characteristics previously defined. 


Flight functions and avionic functional capabilities are defined that will permit 
compliance with these ACT-sensitive ATC clearances. 
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4.2.2 ACT-SENSITIVE OPERATING CHARACTERISTICS 


In most respects, the Conventional Baseline and Initial ACT Configuration designs are 
similar. The design maximum takeoff gross weight (MTOGW) is the same for both designs. 
However, the operating empty weight (OEW), maximum zero fuel weight (MZFW), and 
maximum landing weight (MLW) are all 910 kg (2000 lb) less for the Initial ACT design. 

Nominal climb, cruise, and descent speeds are identical for both designs; consequently, 
the two configurations have similar noise characteristics. 


The Initial ACT Configuration does result in reduced empennage drag due to its smaller 
size, less trim drag due to a farther aft center of gravity (eg), and reduced OEW due to 
the smaller empennage with its low design air loads. These design improvements result in 
the following ACT-sensitive operating characteristics: 


• Takeoff field length decreased by 4%, 90m (300 ft). 

• Landing approach speed decreased by 2%, 1.4 m/s (2.7 kn). 

• Tail clearance angle at touchdown reduced from 4 to 3 deg. 


t 


• Performance improvements of: 

• A 3.3% decrease, 180 kg (400 lb), in block fuel at average stage length of 863 km 
(466 nmi). 

• 6% fuel saved at baseline range limit of 3590 km (1938 nmi). 

• A 13% increase in still air range, 472 km (255 nmi), at the fixed-design MTOGW. 


An ACT-sensitive cruise characteristic is noted in Reference 4. The Initial ACT 
Airplane's ability to begin step climb from 10 670m to 11 890m (35 000 to 39 000 ft) at a 
higher gross weight than the Conventional Baseline Airplane results in a cruise range 
extension of 204 km (110 nmi). The improved lift-to-drag ratio at cruise allows the Initial 
ACT Airplane to fly two-thirds of its cruise distance at 11 890m (39 000 ft), compared to 
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the Conventional Baseline Airplane, which must fly two-thirds of its cruise distance at 
10 670m (35 000 ft) before being able to step climb to the higher altitude. The difference 
in step-climb location for the two configurations is about 930 to 1110 km (500 to 600 nmi). 


o 


Because of the reduced OEW, 907 kg (2000 lb) of additional fuel load can be carried at the 
fixed design payloads and MTOGW. If a malfunction occurs that prompts a return to the 
departure airport, that additional fuel must be dumped to achieve the MLW. 

As a fix for an inboard wing flutter problem in the Initial ACT Configuration (refs 4 
and 5), a constraint was placed on the transfer of fuel from the structural reserve fuel 
tanks. Because of the flutter stability added by 1405 kg (3100 lb) of fuel in the wing tips, 
normal operational and margin speeds are available only with these tanks full. Transfer of 
fuel from these tanks will normally occur after airplane fuel weight is less than 3175 kg 
(7000 lb). A reduction in operational and limit speeds will then be necessary to retain 
appropriate speed margins. Maximum operating airspeed will be reduced by approximately 
26 to 36 m/s (50 to 70 kn) due to this procedure. The impact of this limit speed reduction 
will be minimized due to maximum operating Mach number becoming the limiting high- 
speed constraint above about 6000m (20 000 ft) and the ATC-imposed speed limit of 129 
m/s (250 kn) below 3050m (10 000 ft). Impact is also minimized because transfer of fuel 
from the structural reserve tanks usually occurs during reserve fuel usage and will not 
happen during a normal flight. 

The Final ACT Configuration design (defined in refs 8 and 9) will have no speed 
constraints arising from reserve fuel usage because the higher-aspect-ratio wing did not 
exhibit the same flutter mode and did not result in a structural reserve fuel tank problem. 


The Initial ACT Airplane operating envelope boundaries are more sensitive to flight 
control system faults than the Conventional Baseline design. Depending on which active 
control modes have failed, and the extent of the failure, four possible flight modifications 
are required: 


• Restrictions on the operating envelope are necessary to provide adequate speed 
margins when speed pitch-augmented stability (PAS), lateral/directional-augmented 
stability (LAS), or flutter-mode control (FMC) functions are lost. 
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• If short-period PAS function redundancy is reduced to only two success paths, or if 
speed PAS, LAS, and wing-load alleviation (WLA) all fail, safety factors require an 
immediate diversion to a landing on the nearest adequate runway. 

• If angle-of-attack limiting (AAL) or WLA functions fail, special caution must be 
exercised but no specific restrictions apply. 

• When one failure away from loss of PAS (speed), the airplane must be dispatched into 
a restricted flight envelope. 

4.2.3 ACT-SENSITIVE ATC CLEARANCES 

A list of present and future ATC clearances (refs 6 and 7) was reviewed to determine 
which ACT-sensitive operating characteristics could be impacted by clearances. A 
comprehensive range of clearances was analyzed, including taxi, takeoff, vectoring, route, 
altitude, speed, holding, approach, and landing clearances, to cover all phases of flight. 

Because of the relatively small improvements in takeoff field length and approach speed, 
no effect on ATC clearances is expected, nor will the reduced tail clearance angle have 
an impact. 

A possible impact on ATC clearances could result from the 10% fuel load increase 
discussed previously. Burning or dumping that additional fuel in the event of a forced 
return for landing could require additional coordination with ATC. No specific clearance 
item can be identified due to this factor; however, holding or vectoring assignments could 
possibly be affected. The impact would probably be minimal due to the relatively small 
fuel increase involved and because fuel dumping is an improbable event based on past 
experience. 

Another possible impact on ATC clearances could result from the structural reserve fuel 
tank effect previously discussed. A 4-D ATC system will use aircraft operating envelope 
data to generate conflict-free speed assignments. Clearances such as "adjust speed to 
cross (location) at (time)..." or "increase speed to (amount) knots..." must consider the 
high- and low-speed boundaries of that particular aircraft. If the high-speed limit is 
reduced during flight by 26 to 36 m/s (50 to 70 kn), the ATC data base must be updated to 
ensure that continued aircraft-compatible clearances are generated. 







The sensitivity of the operating envelope to flight control system faults could similarly 
impact ATC clearances. If the high- or low-speed limits for the Initial ACT Airplane 
change, such as when speed PAS, LAS, or FMC are inoperative, the ATC data base must 
be updated for continued compatibility. 

The required diversion to the nearest adequate runway impacts many types of ATC 
clearances. Altitude clearances such as "cleared for pilot's option descent to (altitude)" 
will probably be affected, as will route clearances. 

The special caution required by AAL or WLA failures will probably have the greatest 
impact on speed and altitude clearances. ATC should be aware that clearances requiring 
prompt compliance are not desirable, as the crew must evaluate the safety factors 
involved. 

The improvement of fuel versus still air range is not expected, in itself, to impact ATC 
clearances. However, the ability of an ACT airplane to obtain such improvements in fuel 
efficiency depends on receiving clearance from ATC for the step climb at the desired 
time. As previously discussed, almost one-half of the cruise range increase possible with 
the Initial ACT Configuration is due to beginning the step climb 930 to 1110 km (500 to 
600 nmi) earlier in cruise. An altitude clearance and possibly a route clearance will be 
required for this maneuver but may not always be available depending on the traffic 
situation. 


4.2.4 AVIONIC FUNCTIONAL CAPABILITIES DEFINED BY ACT-SENSITIVE 
CLEARANCES 


Table 5 lists ACT-sensitive operating characteristics, associated ATC clearances, impact 
on ATC, and suggested avionic functional capability. Use of the Mode-S data link is 
suggested to provide the ATC system with updates on airplane operational speed limits 
and other constraints. 


4.2.5 CONCLUSIONS 


ACT-sensitive operating characteristics have been determined and relevant ATC 
clearances identified. In many cases, either the nature of the operating characteristics 
precludes any impact on ATC clearances or the change is so small that additional avionic 
functional capability does not seem warranted. 
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One item that does suggest additional functional capability is the reserve fuel tank effect 
on the high-speed limit. Because the Final ACT Configuration design will not reduce the 
high-speed limit, otherwise incurred by the reserve fuel tanks, no additional functional 
capability is proposed. 


The benefits of the Initial ACT Configuration are substantially dependent on being able to 
cruise at a higher altitude for a longer distance than the Conventional Baseline. While no 
additional functional capability is recommended, receiving a clearance for an efficient 
step climb, or for any other fuel-efficient maneuver, will be most probable when ATC has 
a data base containing all pertinent airplane performance characteristics. 


Table 5. Interaction of the Initial ACT Configuration Design With the Air Traffic Control System 


ACT-sensitive 

operating 

characteristics 

ATC clearances 
affected 

Impact on ATC 

Suggested avionic 
functional capability 

Step-climb benefits 

Altitude and route 
clearances 

ATC system requires 
knowledge of optimum 
step-climb position far 
enough in advance to 
attempt rerouting if 
necessary 

None 

Reserve fuel effect 
on high-speed limit 

Speed and time 
assignments 

ATC data base must 
be updated 

Restrictions to 
operating envelope 
relayed to ATC 
via Mode-S 

910 kg (20001b) of 
additional fuel 
dumped before 
landing at MLW 

Holding and vectoring 

Increased workload when 
this improbable event 
occurs 

None 

Diversion to nearest 
adequate runway 

Altitude, speed, route, 
approach, and landing 

Increased workload with 
possible manual control 
techniques when this im- 
probable event occurs 

Diversion request 
and any operating 
restrictions relayed 
to ATC via Mode-S 
D/L 

Special caution 
required due to AAL 
or WLA inoperative 

Clearances requiring 
prompt compliance 

Increased workload with 
possible manual control 
techniques for ATC and 
crew coordination 

Request for priority 
handling relayed to 
ATC via Mode-S D/L 

Restricted operating 
envelope due to speed 
PAS, LAS, or FMC 
failures 

Speed and time 
altitude assignments 

ATC data base updated 
to include current 
operating envelope 

Restrictions to 
operating envelope 
relayed to ATC via 
Mode-S D/L 
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In summary, no additional avionic functional capability seems to be dictated by 
consideration of ATC clearances for normal flight operations of the ACT design. Some 
flight control system failure mode characteristics appear to indicate that if these data 
(operating envelope restrictions, diversion requests, and priority landing) are relayed to 
ATC via Mode-S data link, flight safety and efficiency will be enhanced. 








5.0 1990s AVIONICS TECHNOLOGY ASSESSMENT 


It is difficult to accurately predict the future state of technology. This is particularly 
true for the avionic technical areas that are discussed in this document. For example, 
digital electronics has advanced much faster than earlier forecasters predicted. Other 
technologies, such as flat panel displays, have not developed as fast as many expected. 
The pace of microelectronics growth continues to confound many experts, especially those 
who firmly believe that technology responds primarily to demand. Recent advances in 
microelectronics actually appear to lead the demand for them; i.e., technology 
applications are developed after the technology advances. Of course, one reason 

microelectronics has made such rapid advances is that it is not (yet) a capital-intensive 
industry; hundreds of fiercely competitive small .companies entered a field where 
technical advances depend more on long hours and dedication than on major capital 
investment. 

On the other hand, advancements in technical areas such as flat panel technology may be 
technically feasible today but will require large capital investments for final development 
and production startup. If the demand is not already there, then the product should be 
either much better or much cheaper, or both, than the item it replaces, or it should be a 
new marketplace item that creates its own demand. The aircraft industry generally does 
not greatly influence fundamental technology (notable exceptions are aerodynamics, jet 
engines, materials, and control systems) because the few thousand aircraft produced per 
year simply cannot support the investment required. Even the automobile industry, with 
its several million cars produced per year, cannot influence technology as much as 
consumer products such as telephone systems, hand calculators, electronic games, 
watches, home entertainment devices, etc. Although the microelectronics industry is not 
currently capital intensive, the total industry resources expended have been large; they 
have simply been spread among many industry elements. 

Commercial aviation and military and space programs have benefited greatly from 
Government-sponsored research and development. The technological benefits from these 
programs could not have been financed privately; the required resources were not 
available to commercial enterprise. Developments such as head-up displays, microwave 
landing systems, and collision avoidance systems that are being or will be implemented in 
new-generation aircraft are examples of such Government programs. Thus forecasting 



technological advances in areas that are largely Government funded is probably less risky 
than forecasting technological advances in microelectronics. 

The technology areas assessed are data communications, data processing, actuation, and 
controls and displays. Sensor technology, another very important avionic function, was 
addressed in References 6 and 7 and therefore is not repeated here. 

A more detailed summary of the technological assessment is presented in Appendix A. 

5.1 DATA COMMUNICATIONS 


5.1.1 INTRODUCTION 

In the 1990s, it is expected that avionic and control system architectures will use 
multiple, distributed digital modules. These systems will be implemented using high-level 
languages with 32- and 16-bit processors. Data communication among the processors and 
the peripheral devices (i.e., sensors, actuators, displays) is the significant system link. 

This section introduces two current data communication systems that are specific to 
aircraft: MIL-STD-1553B and the Aeronautical Radio Incorporated (ARINC) 429 data 

buses. Also, the Digital Autonomous Terminal Access Communication (DATAC) data bus, 
which is a strong contender for the 1990s-era avionic data communication system, is 
described. Alternative DATAC transmission media (current mode and fiber optics) are 
discussed in Subsection 5.1.5. These systems are compared in Reference 10 and 
summarized in Subsection 5.1.6. 

5.1.2 MIL-STD-1553B 

MIL-STD-1553B defines a high-speed, bidirectional transmission medium that has a low 
error rate and uses a twisted, shielded pair of conductors. As many as 31 terminals can be 
connected to the data bus. Each terminal can also be connected to a number of sensors 
and instruments. The military standard protocol carries all address data, command data, 
and information in serial format on a single data bus. Bus traffic is directed by the 
designated bus controller. This controller function can be independent of any terminal or 
can be colocated with selected terminals on the bus. The current version allows dynamic 



reassignment of the control function between appropriate terminals and monitors if a 
given bus controller malfunctions and has the attendant overhead penalty for this multiple 
terminal and controller checking, testing, and switching function. The signals on the bus 
are composed of address and command, data, and status words. Each word is 20 bits long 
and is transmitted in a serial, digital, Manchester II biphase format at a bit rate of 1 MHz. 
The first 3-bit time period is called the synchronizing field and is followed by 16 
information bits of command, data, or status and a parity bit. 

The bus controller issues command words so that information can be exchanged between 
(1) controller and terminal, (2) terminal and controller, (3) terminal and terminal, and (4) 
broadcast. The signals of the first three types of transmissions are composed of common 
status words and blocks of up to 32 data words, while in the fourth type, or broadcast, the 
controller issues a 20-bit receive command word to specific addresses and follows with a 
block of up to 32 data words. Only properly equipped terminals can recognize broadcast 
commands and receive the data. 

The MIL-STD-1553B data transmission network with its distributed control capability can 
be very reliable and can provide a degree of adaptiveness to the avionics system. 
However, problems of increasing complexity and overhead burden exist when a large 
number of terminals, such as 100 units, are interconnected by a single bus. 

5.1*3 ARINC 429 

The ARINC 429 data transmission system is a relatively low-speed, high-reliability bus 
that typically consists of one twisted, shielded pair of conductors. Serial data transfer is 
unidirectional from data source to data receivers. Each data word is encoded in binary or 
binary-coded decimal. The data words are composed of 32 bits, including label, word 
type, and a parity bit. Files with 127 records or less may be transferred. Each record can 
have as many as 126 data words. A transmitter that is prepared to send data to a receiver 
will first send a "request to send" word, and the specific receiver will reply with a "clear 
to send" word by separate bus. Following transmission of the data, the receiver then 
processes the information in the transferred file data and sends a "data received OK" 
word back to this transmitter if there are no errors such as parity or file size. A number 
of protocol provisions are provided for error corrections during file transfer. 
Synchronization is achieved by gap width, where a minimum gap width of four bit times 



precedes the beginning of a new word. Two data rates are available, the high-speed 
100K bps and the low-speed operation, which is within the range of 12K to 14. 5K bps. One 
constraint is that the high and low bit-rate messages cannot be intermixed on the same 
bus. 

5.1.4 DATAC 

Development of a two-way serial transmission data bus for system avionics is consistent 
with the long-range goals of the airlines, as represented by ARINC. When the ARINC 429 
system was conceived in the early 1970s and adopted by ARINC as a standard in the mid- 
1970s, it was recognized that there were many potential advantages to a multiple-access 
data bus. ARINC 429 simply represents the conservative first step in the evolution of a 
commercial transport digital data system. The DATAC data bus system could become a 
candidate for a second ARINC bus standard, mutually compatible with the ARINC 429 
system for many years, but gradually becoming the dominant system because of its 
weight, cost, and reconfigurability advantages. 

The DATAC data bus system can use either current mode or voltage mode (employing 
twisted pair) or fiber-optic mode transmission and has the following basic characteristics: 

• Bidirectional, time-division-multiplexed operational protocol is used. 

• Any practical number of autonomous terminals is allowed. 

• All terminals are identical. 

• All messages contain unambiguous data identification. 

• Transmissions from a given terminal typically are of constant duration and occur 
periodically. 

• Transmission intervals are nominally the same for all terminals on the same bus. 

• Transmissions may have any planned information format provided that gaps during 
these transmissions are of shorter duration than those gaps separating transmissions 
from different terminals. 
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• Total duration of transmissions and gaps for all terminals on a bus must be less than 
the transmission interval for that bus. 

• The transmission gap (i.e., the period of silence preceding any transmission of a given 

terminal) must be unique to that terminal. 

The following protocol must be obeyed by all participating terminals: 

• A terminal is in the receive mode, except when it is in the transmit mode. 

• Terminal (i) transmits when the following conditions are satisfied: 

• Transmission interval T (duration since the beginning of the previous 
transmission by terminal (i)) has expired. 

• Transmission gap (g) has expired and the bus is still available. 

Note that T1 = T2 = T3 . . . = Tn and gl<g2<g3 . . .<gn. 

Two protocols, A-mode and B-mode, have been developed for DATAC. Both A- and 
B-mode protocols are simple in concept and display adequate behavior even in the 
presence of bus overload resulting from a planning error. The carrier-sense feature 
provides the basic stimulus to the transmission-delay mechanism. Each mode has two 
such mechanisms: one for clash-free priority resolution and the other for voluntary 
transmission deferral. For both modes, each terminal has a resettable gap timer, 
programmable by pin selection to a unique gap time for priority resolution. 


A-mode operation is characterized by periodic transmission by each terminal in the 
system, and B-mode operation allows terminal message durations to change continually. 


Subsystem interface operation can also be controlled by the DAT AC terminal on the basis 
of entries in the "personality" eraseable, programmable read-only memories (EPROM) 
within the terminal. For simple subsystems, such as sensors, actuators, etc., no other 
processing capability will be needed for data routing. At the other extreme, a real-time 
computation in a microprocessor-equipped line replaceable unit (LRU) can be served by a 
DAT AC terminal through a shared read-write random-access memory (RAM), processor 
direct memory access (DMA), or by an interrupt procedure. 
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5.1.5 DATAC TRANSMISSION MEDIA 


The two most promising transmission media for DATAC are current mode twisted-wire 
pairs and optical fibers. The current mode medium has highly desirable system reliability 
capability; fiber optics has high immunity to induced signals due to electromagnetic 
interference or lightning and high bandwidth capability. The choice of transmission 
medium in specific future applications will depend on local requirements and relative 
demonstrated cost, weight, and reliability. 

5. 1.5.1 Current Mode Bus Medium 

The current mode data bus is excited, and signals on the line are sensed, by ferrite cores. 
Transformers are formed by inserting turns of the twisted-pair wire onto the cores. Split 
cores are used so that they can be inserted without cutting the line, thus maintaining 
integrity of the main bus. 

The line can be operated to above 1 MHz. Successful operation of the main bus can be 
maintained even with multiple failures of cores or windings. Because split cores are used, 
the line is never cut. Conductive connections are needed only on the ends to properly 
terminate the line. 

5. 1.5. 2 Fiber-Optic Bus Medium 

Among the major advantages of fiber optics are no pickup of external electromagnetic 
fields, no radiofrequency interference, or crosstalk; elimination of grounds and shorts in 
cabling; large bandwidths for the small size; light weight; and high temperature 
properties. For avionic applications, single multimode, graded index fibers will probably 
predominate as light waveguides until gigahertz bandwidths are required or optical 
switching techniques become a major requirement in data processing and handling. 

The connectors mating the components of a fiber-optic data bus system are the main 
sources of attenuation. Multiport star couplers that meet military requirements are 
currently being produced. Their intrinsic loss figures are at the 2-dB level, and future 
development is not expected to significantly improve their performance. Within a year, a 
fiber-optic connector suitable for avionics use will be available. 
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5.1.6 ARINC 429, MIL-STD-1553B, AND DATAC SYSTEM COMPARISONS 


Boeing has compared the characteristics of the data bus types ARINC 429, MIL-STD- 
1553B, and DATAC; this comparison is contained in Reference 10. 

Figure 3 illustrates a generalized installation configuration of the three candidate 
systems: the commercial standard, ARINC 429; the military standard, MIL-STD-1553B; 

and the proposed DATAC system. Figure 3 uses a rudimentary system configuration 
consisting of three remote devices, each requiring a number of data inputs from the other 
two units. The ARINC 429 system, using a separate bus for each of the data sources, 
would appear to provide the highest degree of independence because it is not limited to 
one single-channel medium. However, ARINC 429 hardware is penalized with numerous 
connectors and wires, high weight, and high cost. An individual receiver needs to be 
provided in each unit for each data source. 

The MIL-STD-1553B system, with its distributed bus controller transfer capability, 
provides a degree of adaptiveness at the cost of increased complexity and overhead 
burden as the number of terminals increases. 

The system autonomy achieved by the DATAC system approaches that of ARINC 429, in 
that any of the participating systems can use the data bus regardless of the operational 
status of any of the other systems. Furthermore, many changes in the communication 
requirements of a given system can be made without any effect on the programming or 
operation of other systems in a DATAC network. The DATAC bus— with its bidirectional, 
time-division-multiplexed operation, compared with the ARINC 429 characteristics— has 
the additional advantage of requiring significantly less hardware, such as connectors and 
wiring. 


5.2 MICROPROCESSORS 

The following items comprise a general consensus of the surveyed materials listed in the 
Appendix A references: 

O Future avionic designs will be digital, and— with microelectronics providing the least 
costly hardware configurations— microprocessor and computer technology will 




















become predominant. Available memory has been a limiting factor in digital 
electronics; but with single-chip 64K dynamic RAMs in production today and 256K to 
1M bit dynamic RAMs expected in the next few years, adequate affordable memory 
will be available for all but a few special applications. With the increased memory on 
a single chip, single-chip microcomputers should grow in capability and complexity. 
The capability to provide high-level functions in hardware and firmware will simplify 
software requirements. 


• Microprocessors with word lengths of 16 and 32 bits are now available and will 
certainly be commonplace in 2 or 3 years. These gains in microprocessor complexity 
and speed should reduce processing times, with chip minor cycle times of less than 
20 ns. LRU major frame times of 10 to 20 ms do not appear to pose problems in the 
future, except for very large algorithms. 


o 


• High-level structured languages, in conjunction with 32-bit microprocessors, are 
expected to lead the way to increased programmer productivity, increased software 
reliability, and reduced software life cycle costs. 

• Special applications (such as signal processing, servo control, etc.) will very likely be 
achieved by special-purpose, single-chip processors with onchip memory or the use of 
logic arrays combined with computer-aided design (CAD) techniques, thus providing 
the system designer with a universal, flexible component. Logic arrays of well over 
10 000 uncommitted gates will be available in a year or so. To use logic arrays 
effectively, sophisticated design-automation technology development will be 
required. 


• Nonvolatile memory such as magnetic bubble memories are expected to provide 
excellent reliability and storage densities of up to a million bits per device. Bubble 
memories occupy less volume than either semiconductor memories or floppy disks for 
the same storage capacity. Presently, bubble devices only operate over a limited 
temperature range and the power dissipation currently is too high; however, research 
continues. 
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5.3 ACTUATORS AND ACTUATOR CONTROLLERS 


Actuators provide power for flight controls, engine controls, thrust reversing, landing gear 
retraction and extension, nose-wheel steering, brakes, wheel well doors, and other 
functions on commercial transports. Most of these functions presently use hydraulic 
actuators. However, recent high-efficiency electric motor and control developments may 
make electromagnetic actuators competitive with hydraulic actuators in this decade. 

In the near term, commercial transport designers will usually use more-or-less 
conventional hydraulic systems for flight-crucial controls (subsec 6.2.2) because 
all-electric surface controls have not yet been developed that can perform the required 
functions with competitive advantages in weight and reliability. However, all-electric 
control functions have been used on current new-generation commercial transports; e.g., 
the Boeing 757 is planning to use a full-authority electronic engine control on the Pratt & 
Whitney 2037 engine, with no mechanical or hydraulic system backup. Airplane actuator 
technological development is focused on achieving benefits in weight, design flexibility, 
reliability, and maintainability. Some of these technology objectives could result from 
efforts outside the airplane industry; e.g., as industries (such as automobile 
manufacturing) become more automated, reliability of the robotized production lines will 
become an important consideration and there will be more incentive to develop improved 
actuator components. 

Currently, on a system component basis, electric actuators still weigh from 10% to 30% 
more than their hydromechanical counterparts. When the hydraulic power and distribution 
system is included, a closer weight parity may be achieved. As developments in load- 
adaptive actuators evolve (both electric and hydraulic), significant weight reductions will 
be achieved. The principal benefits expected from electric actuation systems will be 
design flexibility and simplified maintenance. Integrated actuator packages (IAP) and 
electromechanical actuators are expected to become dominant in the 1990s for 
commercial transport applications. 



5.4 FLIGHT DECK CONTROLS AND DISPLAYS 


Design of the flight deck— the operator-machine interface— is achieved under a nearly 
fixed set of constraints that is dictated by the form and functional limits of the human 
operators. Those changes that occur in the operator-imposed constraints involve more 
precise definition, not improved inherent operator capacity to perform his functions. 

In contrast to the fixed capacities of the operator, increasing airplane system 
complexities— together with the requirement for the operator to monitor, interpret, and 
react to an expanding bevy of parameters— eventually resulted in a requirement for 
multiparameter controls and displays to reduce the congestion and workload inherent with 
single- or double-parameter display, test, and control devices. Multifunction keyboards 
and displays were developed, suited to flight deck operational requirements. 
Electromechanical instruments of the kind used since the 1920s, however, are still 
incorporated into the flight decks of commercial aircraft flying in the 1980s. And some 
of these instruments may still be required in the 1990 ACT airplane as analog backup for 
functions and parameters of flight-crucial significance for which a satisfactory all- 
electronic redundancy scheme cannot be practically achieved. 

The 1990 ACT airplane flight deck will be fully integrated, all-electronic fly by wire 
based on digital avionics. New cockpit controls and displays being developed in 
1980 to 1990 will be ready for installation in the next-generation transport. 

It is predicted that multicolor cathode-ray tubes (CRT) will continue to dominate the 
market for use in cockpit display of imagery. The requirement to display weather radar, 
forward-looking infrared (FLIR) radar, and TV video on the electronic attitude director 
indicator (EADI) and electronic horizontal situation indicator (EHSI) presents a challenge 
to flat panel technology that may not be met by 1990. Flat panels are expected to be 
rugged, to have a low packaging profile and high luminous efficiency, to be highly reliable, 
and to make good progress in the next decade. However, it is not certain that they can 
overcome the longer history and certain advantages of the CRT (table 6) in the near term. 
For display of sensor video (TV, FLIR, radar) on the EADI and EHSI, color CRTs will 
dominate the market throughout the 1980s. A flat panel display with the best chance of 
replacing CRTs in the next few years is probably electroluminescence (EL), specifically 
thin-film EL (TFEL). 



Table 6. Summary— Display Technology Comparison Matrix 


Characteristic 

Desired 

CRT 

EL 

(thin film) 

LC 

LED 

Plasma 

Common 

sizes 

1 5 x 20 cm 
(6x8 in) 
<2.5-cm 
Kl-in) depth 

13x 18cm 
(5x7 in)(usable) 
<36-cm 
K 14-in) depth 

13 x 15 cm 
(5x6 in) 
<2.5-cm 
Kl-in) depth 

9 x 9 cm 
(3.5 x 3.5 in) 
<2.5-cm 
Kl-in) depth 

10 x 13 cm 
(4x5 in) 
<2.5-cm 
Kl-in) depth 

21.5 x 21.5 cm 
(8.5 x 8.5 in) 
<2.5-cm 
Kl-in) depth 

Luminance 

(filtered) 

50 to 100 

4.6 to 44 raster 
25 to 300 stroke 
(B-R-G) 

40 

Illumination 

dependent 

120 

20 to 50: ac 
0to50: dc 

Shades of gray 
at 108 000 lx 
(10 000 fc) 

6 to 8 

6 to 8 

2 

(16 predicted) 

8 to 10 

4 to 6 

ac: 2 
dc> 16 

Contrast ratio 
at 108 000 lx 
(10 000 fc) 

7.5:1 HDD 
1.2:1 HUD 

4:1 color 
12:1 mono- 
chromatic 

1.5:1 

(10:1 

predicted) 

20:1 at60°C 
(+140°F) 

2:1 at 0°C 
(+32°F) 

6:1 

1.6:1 

Colors 

8 to 16 

>20 

2 to 3 (B-G-Y) 
(full color 
predicted) 

1 normally 
(3 predicted) 
(R-G-Y) 

4 (R-O-Y-G) 

1 green 
1 neon orange 
Full color using UV 
predicted 

Resolution, 

lines/cm 

(lines/in) 

26 to 40 
(65 to 100) 

32-dot triad 
per centimeter 
(80-dot triad 
per inch) 

20 (50) 

26 to 80 
(65 to 200) 
predicted 

40 (100) 
reflective 
24 (60) 
transmissive 

25 (64) 
mono- 
chromatic 
9 (23XR-G) 

24 to 35 
(60 to 88) 

Refresh rate, 
Hz 

50 to 100 

50 stroke 
40/80 raster 

60 to 250 

Slow (TV 
rate blurred) 

500 (typical) 

None (bistable) 

Rise or fall 
response 

TV rate 
(0.2 ms) 

0.2 ps to 1 ms 

2 iis to 1 ms 

1 0 ms to 
1 sec 

10 ns 

20 fis 

Operating 
temperature, 
°C (°F) 

-55 to +125 
(-67 to +257) 

-20 to +70 
(-4 to +158) 

-40 to +100 
(-40 to +212) 

-25 to +60 
(-14 to +140) 

-40 to +70 
(-40 to +158) 

-60 to +60 
(-76 to +140) 

Voltage 
and power 

115V ac, 
400 Hz 

> 18 kV 
0.78 W/cm 2 
(5 W/in 2 ) 
(typical) 

30V to 
650V ac _ 
0.125 W/cm 2 
(0.8 W/in 2 ) 
(typical) 

2V to 35V dc 
0.031 W/cm 2 
(0.2 W/in 2 ) 
(average) 

1.5V to 
5.0 V dc 
3 W/cm 2 
(20 W/in 2 ) 
(typical) 

140V sustain 
200V firina 
0.47 W/cm 2 
(3 W/in 2 ) 
(typical) 
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Table 6. Summary— Display Technology Comparison Matrix (Concluded) 




Characteristic 

Desired 

CRT 

EL 

(thin film) 

LC 

LED 

Plasma 

Luminous 

efficiency, 

Im/W 

Maximum 

20 (typical) 

2 to 5 
(typical) 

N/A 

0.5 (typical) 

0.3 (DIGIVUE) 

Dominant 

wavelength 

555 nm 

Varies with 
phosphor type 

525 to 585 

Varies 

470 to 650 

585 (neon) 

MTBF (high 
ambient) 

>10 000 hr 

3000 to 5000 hr 
(10 000 hr 
predicted) 

10 000 hr 
(20 000 hr 
reported) 

10 000 hr 
(20 000 hr 
predicted) 

10 000 hr 
(25 000 hr 
predicted) 

>10000 hr 

Viewing 

angle 

±60 deg 
(minimum) 

±80 deg 

±90 deg 

±15 to 
±40 deg 

± 45 deg 

±70 deg 

Readability 

(high/dark) 

Excellent/^ 

./"Excellent 

Excellent^^^ 

Excellent 

Marginal/^ 

./"Excellent 

Excellent/^ 

Poor 

Good 

./Good 

Marginal 

Poor 

Cost 

Minimum 

• $4700 
commercial 

• $15 750 
flight quality 

• $3500 to 
$5000 

• Nonflight 
quality 

Unknown 

(no 

production 

quantities) 

• $6500 
nonflight 
quality 

• $620/cm^ 
($4000/in 2 ) 
with drivers 

.$4000 to $9500 
• Nonflight quality 

Devices 

recommended 

(1980/1990) 

• Video 

• Graphics 

• Messages 

• Discretes 

• Video 

• Graphics 

• Messages 

• Discretes 

• Messages 

• Discretes 

• Messages 

• Discretes 

• Graphics 

• Messages 

• Discretes 

• Graphics 

• Messages 

• Discretes 

• Video 

• Graphics 

• Messages 

• Discretes 

• Graphics 

• Messages 

• Discretes 

• Graphics 

• Messages 

• Discretes 

• Graphics 

• Messages 

• Discretes 

• 1990- 
same as above 


For display of graphics, alphanumeric messages, and discretes, it is predicted that any one 
of the flat panel technologies can perform adequately. During 1980-85, light-emitting 
diodes (LED) will lead the field in cockpit applications, especially for the Traffic Alert 
and Collision Avoidance System (TCAS), Mode-S, ARINC communication addressing and 
reporting system (ACARS), and multifunction keyboard (MFK) displays. But because of 
high power consumption, cooling requirements, and cost, they will yield to the more 
efficient TFEL, which uses only 1 /20th the power of LED, has twice the viewing angle, 
and is many times more light efficient than LED. 

An improved flight management system will integrate 4-D navigation, communication, 
guidance, and performance (including energy) management functions, optimized for fuel 
savings within air traffic control (ATC) constraints. Present keyboards will be replaced 
with MFKs for manual data entry, recall, and modification of stored data. Data presented 
to the crew will consist of a logical and meaningful sequence of displayed ’’pages' 1 and will 
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prevent insertion of incompatible options. Flight plans and bulk data storage will be 
automatically inserted with cards and tapes, respectively. Route changes and verification 
of flight plans will be integrated with Mode-S. Voice-actuated controls will allow 
communication with the flight management system, perhaps as the primary input device 
with the MFK. 

Low-profile throttles and center stick control will open up the prime display area. 

Electronic throttles, elevator trim, and flap controls will make available more panel space 

* 

on the forward instrument panel for display of Mode-S messages. A center stick would 
unblock the display area for EHSIs, an area now partly obstructed by the traditional wheel 
and column. 

By replacing standard electromechanical (or even CRT) engine instruments, thin flat panel 
displays, less than 2.5 cm (1 in) deep, will provide additional space behind the glareshield 
for installation of holographic head-up display (HHUD) relay optics and projection 
electronics. Symbolic information will be projected onto large HHUD combiners or 
perhaps even on the windscreen, in all probability with liquid-crystal (LC) transmissive 
projection systems. 

Most of the system controls and displays on the overhead panel will disappear with the 
advent of MFK and multifunction displays (MFD). If needed, graphics and alphanumeric 
information can be shown on displays located on the forward main instrument panel. 

The primary flight displays will be full-color CRT, multifunctional, interchangeable, and 
compatible with ARINC standard racks and panels for common insertion and removal. 
The flat panel displays for engines and systems will be full color, multifunctional, and 
ARINC compatible. By 1995, it is predicted that all of these displays will be flat panel 
and standardized for interchangeability. The other smaller displays used for instruments, 
caution and warning, navigation, communications, and keyboard readout devices will be 
flat panel, full color, standard width, and interchangeable. 
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6.0 ACT AVIONICS AND FLIGHT DECK SYSTEM FUNCTION DEFINITION 


The objective of this effort was to define integration of the active control functions into 
an integrated avionics system. The system was to be defined at a level appropriate for 
simulation of the integration concept. Because the focus of the effort is integration of 
active controls, the scope of the study was limited to those other functions affected by or 
that affect the active control functions. Therefore only the functions involved in active 
controls, normal flight control, and guidance were considered in the detailed portions of 
the study. Figure 4 shows the approach taken to develop the integrated system. 

Many of the concepts and guidelines presented in References 11 through 16 were used in 
the development and analysis work discussed in this section and in Section 7.0. 



Refine 

concept 


Develop 
ground rules 
and guidelines 


Define concept 
architecture 


Preliminary architecture 


Analyze 
performance 
and failure 
behavior 


Selected 

architecture 


Figure 4. Development Approach 
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The first step then was to define top-level functions expected to be performed by the 
1990s airplane avionics system. The top-level function list was developed by reviewing 
the functions performed on current aircraft, functions defined in the Aeronautical Radio 
Incorporated (ARINC) 700 series documentation, and airborne functions due to be added 
because of the changing operational environment, including the Active Controls 
Technology (ACT) functions. Subsection 6.1 presents the resulting top-level functions, 
except electric power, environmental control, and passenger accommodations. (Many of 
the monitor and alert functions are listed for those excluded functions.) 

The second step was to evaluate the criticality of the top-level functions. The purpose of 
the development approach was to introduce reliability considerations early in the design 
process. To do this, criticality "ratings" are determined that reflect the impact on safety 
or operations of the loss of the top-level functions. These criticality "ratings" are used as 
guidelines for high-level grouping and interconnections of the concept architecture. 
Subsection 6.2 discusses determination of criticality. 

The third step was to define the subfunctions or processes necessary to perform the 
top-level functions. Data processing techniques were used to identify these processes. 
Specifically, data flow diagrams were sequentially generated illustrating the top-level 
functions in progressively more detail. In this way, subprocesses were determined on a 
level suitable for allocation to elements in the concept architecture. Subsection 6.3 
discusses these data flow diagrams or logical function groupings. 


6.1 AIRPLANE CONTROL, MONITOR, AND DISPLAY FUNCTIONS 

The top-level functional list consists of two sections, as shown in Table 7. Section 1.0 
identifies the functions necessary for revenue flight operations. Section 2.0 shows those 
functions that are normally related to relief of aircrew workload or that allow more 
economical flight operations. 



Table 7. Top-Level Functional List 



o 



Function 

number 

Function description 

Function 

number 

Function description 

1.0 

Basic capabilities 

1. 5.4.1 .1 .2 

Automatic terminal information 

1.1 

Control and stabilize airplane attitude 


service (ATIS) 

1.1.1 

Change pitch attitude via column 

1. 5.4.1 .2 

Transponder 


deflections 

1. 5.4.2 

Intracraft 

1.1.2 

Adjust pitch attitude trim 

2.0 

Enhanced capabilities 

1.1.3 

Change roll attitude via wheel 

2.1 

Engage automatic flight control 


deflections 

2.1.1 

Pilot-assisted steering 

1.1.4 

Adjust roll attitude trim 

2.1 .2 

Capture and maintain flight parameters 

1.1.5 

Change side-slip angle via rudder 


(thrust, speed and Mach No., heading and 


deflections 


track, etc.) 

1.1.6 

Adjust yaw trim 

2.1.3 

Capture and track landing system path 

1.1.7 

Change control authority (or trim) as a 


(ILS, MLS, etc.) 


function of flight conditions to main- 

2.2 

Use autonavigation and guidance 


tain flight characteristics (e.g„ rudder 

2.2.1 

Define and store complete flight plan 


ratio changer, outboard aileron lockout. 

2.2.2 

Define and store the desired performance 


elevator feel, Mach speed trim) 


modes that specify the optimal profile(s) 

1. 1.7.1 

Modify pitch control characteristics 


(cost, fuel, time) 

1.1 .7.2 

Modify roll control characteristics 

2.2.3 

Determine airplane state (position, velocity) 

1.1 .7.3 

Modify yaw control characteristics 

2.2.4 

Provide flight parameter targets to follow 

1.1.8 

Augment stability 


optimal flight profile 

1.1 .8.1 

Pitch axis, short 

2.3 

Monitor information displays 

1.1. 8.2 

Pitch axis, speed 

2.3.1 

Display autoflight pitch, roll, airspeed, and 

1 .1 .8.3 

Roll-yaw axis (LAS) 


thrust commands 

1.1.9 

Limit angle of attack (AAL) 

2.3.2 

Display selected thrust limits 

1.2 

Relieve structural loads 

2.3.3 

Display desired flight profile 

1.2.1 

Maneuver-load control 

2.3.4 

Display airplane state (position, velocity) 

1.2.2 

Gust-load alleviation 

2.3.5 

Display aeronautical chart data 

1.2.3 

Flutter-mode control 

2.3.6 

Display performance handbook data 

1.3 

Control and stabilize airplane thrust axis 


(including ACT failure envelope) 

1.3.1 

Change engine thrust as a function of 

2.4 

Monitor crew alerts 


throttle position 

2.4.1 

Flight condition alerts 

1.3.2 

Deploy speedbrakes as a function of 

2.4.1 .1 

Overspeed 


speedbrake lever position 

2.4.1. 2 

Improper configuration 

1.4 

Change airplane configuration for phase of 

2.4.1. 3 

Fire warning 


flight 

2.4.1. 4 

Autopilot disconnect 

1.4.1 

Landing gear 

2.4.1. 5 

Ground proximity 

1.4.2 

Flaps 

2.4.1 .6 

ACT system 

1.5 

Monitor airplane status 

2.4.2 

System status alerts 

1.5.1 

Flight conditions, display 

2.4.2. 1 

Air-conditioning 

1. 5.1.1 

Altitude 

2.4.2.2 

AFCS 

1.5.1 .2 

Vertical speed 

2. 4. 2. 3 

Electrical power 

1.5.1 .3 

Attitude, pitch, and roll 

2.4.2.4 

Fire protection 

1.5. 1.4 

Engine thrust 

2.4.2.5 

Flight control 

1.5.1 .5 

Direction (heading and track) 

2. 4. 2.6 

Fuel 

1.5.1 .6 

Turn rate 

2.4.2. 7 

Hydraulic power 

1.5.1. 7 

Time 

2.4.2.8 

Ice and rain protection 

1.5.2 

System status, display system perform- 

2.4.2.9 

Instruments 


ance (e.g., engine, hydraulics, electrical) 

2.4.2.10 

Landing gear 

1.5.3 

Navigation and guidance display bearing 

2.4.2.11 

Navigation 


and/or distance to navigation aids; dis- 

2.4.2.12 

Pneumatics 


play deviation from selected landing 

2.4.2.13 

Auxiliary power unit 


system path 

2.4.2.14 

Doors 

1.5.4 

Communications 

2.4.2.15 

Engine control 

1. 5.4.1 

Air to ground and ground to air 

2.4.2.16 

Anti -ice 

1. 5.4.1. 1 

Voice 

2.4.2.17 

Engine indication 

1. 5.4.1 .1.1 

ATC and company 

2.4.2.18 

Oil 
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6.2 CRITICALITY DETERMINATION 


Future airplanes using ACT will have new systems whose continuous function is necessary 
for continued safe flight. Other airplane systems enhance performance in some flight 
regimes but may not be flight safety critical if airplane operation is limited to a 
restricted flight envelope when a system malfunction is known to have occurred. Thus one 
of the first steps in defining system requirements is to examine the flight safety 
significance of the system functions. The resulting function criticality indicates the 
minimum level of design verification and validation necessary and the reliability required 
of each individual function. The assessment is achieved by determining the impact of 
function loss on flight safety. 


6.2.1 CRITICALITY ASSESSMENT TECHNIQUES 


Three levels of flight criticality (flight crucial, flight critical, and workload relief) are 
used to categorize the functions— related by their criticality, implementation, and usage in 
a particular type or model. Another category (dispatch critical) is also included to show 
which functions must be operational before an airplane can fly a revenue mission. Table 8 
defines each criticality category and the associated reliability requirements. 


The criticality assessment process includes four basic steps: 

• Clearly defines the capabilities of the function 

• Determines the consequences on safety and/or condition of flight of loss of these 
capabilities 

• Assigns functions to criticality category by selecting the most appropriate category 
from Table 8 that possesses similar characteristics and behavior 

• Determines whether the airplane can be dispatched with function loss 


Finally, function reliability requirements are derived by considering the worst possible 
impact to flightcrew and airplane on function loss and then looking up the corresponding 
failure probability as indicated by the curve in Figure 5. Table 9 shows a typical 
criticality assessment sheet. 
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Table 8. Function Criticality Categorization 


P_atpnnrv 

Effect of function failure or 
design error on the airplane and 
crew 

Probability of occurrence 
per 1-hr flight 

Remarks 



FAA 

definition 

Unofficial [a^> 
interpretation 

A 

Flight 

crucial 

That function whose complete 
loss inevitably results in loss of 
the airplane. The consequence 
of complete function loss can- 
not be averted by procedure 
change or flight envelope 
restriction. 

Extremely 
improbable . 

<10~ 9 


B 

Flight 

critical 

That function whose complete 
loss in a specific portion of 
flight could result in loss of the 
airplane, but such loss could be 
averted by proper flightcrew 
action. 

Probable to 
improbable 

10 -3 to 10' 9 

Includes: 

• Flight envelope critical— a 
function that if lost results 
in certain airplane regimes 
being restricted or results in 
hazardous increase in flight- 
crew workload. 

• Flight missions critical— a 
function that if lost results 
in certain airplane 
operations being prohibited 
or results in potentially 
hazardous increase in flight- 
crew workload. 

C 

Workload 

relief 

That function that impacts 
neither flight dispatch status 
nor flight plan but that has con- 
venience value to flightcrews. 

Loss of function may affect pre- 
cision or economy of flight but 
has no significant effect on safety. 

Probable 

E> 


D 

Dispatch 

critical 

That function without which 
an airplane cannot legally be 
dispatched on a revenue flight. 

Not 

applicable 

< 0.65 delays 
over 15 min 
per 1000 
departures 

Meets minimum requirement 

GE> 


£> 


£> 


E> 


These terms are not intended to define the reliability of specific components of systems but rather to relate 
to the effects on the airplane of a single consequence resulting from the loss of a function or functions. The 
numerical limits are not precise values and judgment should be used in their application. This is reflected in 
the overlap of the limits shown in Figure 5. 

Failure of a single function in this category causes at least "operational limitation." Failure of several 
functions simultaneously, however, may require an immediate diversion to a landing on the nearest adequate 
runway. 

This depends more on economic factors such as cost and weight rather than safety factors. 

The minimum requirement is that necessary to provide compliance to (1) regulatory requirements (such as 
FARs) not associated with the probability ranges and/or to (2) applicable TSO or other equipment 
requirements. 
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Table 9. Function Criticality Assessment 


Function 

Gust-load alleviation (GLA) 

Brief description 

Consequence of failure 

• Reduces the wing structure 
loading that results from 
the airplane penetrating 
vertical (or lateral) gusts 

• Unable to control gust-load onset through deflections of wing controls and to 
pitch the airplane into the gust through commands to the elevators 

• Unable to reduce structural loading at low, rigid-body frequencies 

• Allows continuation of normal flight schedule after GLA is lost in the air because 
the airplane structure ultimate strength exceeds the design limit load 

• Cannot be dispatched on ground because the airplane structural strength is less 
than the design ultimate load at maximum gross weight 

Flight 

criticality 

Critical (B)* 10 -3 to 1CT 4 

Remarks: 

Dispatch 

criticality 

Yes 


*See Table 8 for definition of category B. 


Some top-level functions have a different impact on safety of flight or ability to complete 
the scheduled mission depending on the phase of flight (takeoff, climb, cruise, etc.), flight 
environment (night, weather, icing, etc.), or route (over water, positive radar control, 
radio navigation aid availability, etc.). Some functions are used only in certain phases of 
flight or over certain flight routes, while others have a significant safety effect only if 
they fail in certain environmental conditions. For these functions, the likelihood of the 
conditions must be considered along with the condition-dependent effect of the function 
loss. In this study, most of the functions with condition-dependent effects appear in the 
flight critical category. 


6.2.2 ACT SYSTEM CRITICALITY ASSESSMENTS 


The criticality assessments cover the top-level ACT/control/guidance functions selected 
from the function list in Table 7. Table 10 lists assigned criticality category, minimum 
reliability requirements, and demonstrated past dispatch reliability for these selected 
functions. 

Appendix B contains more detailed criticality assessment data for each of the top-level 
functions. 
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Table 10. Function Criticality (Continued) 


Function 

Flight 

criticality 

Permissible failure 
probability per 1-hr 
flight 

Dispatch 

critical? 

Demonstrated 
past dispatch 
reliability 

Fkmer-mode control 

Critical 

10 -3 to 10 -4 

No 

- 

Display airspeed and Mach 

Critical 

lO^tolO -9 

Yes 

lO^tolO -6 

Display altitude 

Critical 

< 10 -* 

Yes 

lO^tolO -6 

Display vertical speed 

Critical 

<10" 4 

No 

- 

Display attitude, pitch, and roli 

Critical 

<10 -5 

Yes 

10“ 3 to 10- 5 

Display engine thrust 

Workload relief 

10- 3 

Yes 

- 

Display direction (heading, track) 

Critical 

<10 -5 

Yes 

10‘ 5 to10" 6 

Display bearing and/or distance to 
navigation aids 

Critical 

lO-^tolO -4 

Yes 

10" 3 to10" 5 

Display deviation from selected landing 
system path 

Critical 

10 _3 to 10" 4 

Yes 

- 

Communications with voice 

Critical 

lO^tolO -4 

Yes 

10 -3 to 10" 5 

Communications with transponder 

Workload relief 

10' 3 

Yes 

lO^tolO -6 

Pilot-assisted steering 

Workload relief 

10“ 3 

No 

- 

Capture and maintain flight parameters 

Workload relief 

10" 3 

No 

- 

Capture and track landing system path 

Critical 

<10 -4 

Yes 

ss 10 -4 
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Table 10. Function Criticality (Concluded) 


Function 

Flight 

criticality 

Permissible failure 
probability per 1-hr 
flight 

Dispatch 

critical? 

Demonstrated 
past dispatch 
reliability 

Determine airplane state (position, 
velocity) 

Workload relief 

10~ 3 

No 

- 

Provide flight parameter targets to follow 
optimal flight profile 

Workload relief 

icr 3 

No 

- 

Display selected thrust limits 

Workload relief 

10" 3 

No 

- 

Display desired flight profile 

Workload relief 

10' 3 

No 

- 

Display airplane state (position, velocity) 

Workload relief 

10" 3 

No 

- 

Display performance handbook data 
(include ACT failure envelope) 

Workload relief 

10~ 3 

No 

- 

Display autoflight pitch, airspeed, roll, 
and thrust command 

Workload relief 

10~ 3 

No 

- 

ACT system flight condition alerts 

Crucial 

Critical 

10~® 

CIO -5 

Yes 

- 

Flight control system status alerts 

Critical 

< 10- 5 

Yes 

- 
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6.3 LOGICAL FUNCTION GROUPING 


Lists of top-down-ordered functions, such as shown in Table 7, are too complex to use 
alone as system design tools- For this reason, some of the techniques from structured 
analysis have been adopted. Structured analysis provides an orderly procedure for 
presenting system functional relationships, with significant data flow also delineated. 

The first stage of the procedure begins by developing a model of the current physical 
system showing the physical processes that are involved. Next, the current physical 
model is rearranged and expanded in a logical sequence using the generalized system 
functions. From the logical model, the alternative configurations can be identified. After 
selecting a suitable configuration, the significant areas of change for the proposed system 
can be identified. Finally, the proposed physical system can be diagrammed and structured 
specifications prepared. 



The principal method used to develop the data flow diagrams, with their functional 
groupings, was based on DeMarco's approach (ref 11). This graphical method enhances 
understanding of the data flow, which is vital to any system design. The method does not 
guarantee that the optimum design will result, but, if used properly, a logical or workable 
system will be developed. 


The primary elements of the diagrams are the interconnecting paths (data flow) and the 
"bubbles" (processes). The highest level diagrams would show the entire airplane avionic 
system from which groups of the elements can be selected to develop lower level, more 
detailed diagrams. It is the selection of the groupings that may seem arbitrary; selection 
may be based upon similarity of function, equal criticality, proximate physical location, 
etc. The flight control and ACT functions were grouped by criticality, thereby ensuring 
that lower criticality subsystems could not affect those of higher criticality. (For 
systems of lower criticality, it may make sense to group selections on another basis.) 
Once this grouping selection decision is made, development of the data flow diagram is 
almost automatic because the choices are so constrained. 


Data flow diagrams accomplish two important things. The first is a meaningful picture of 
the system; as a byproduct of this picture, a highly useful system functional partitioning is 
presented. The later physical partitioning that is done will relate directly to this 
functional partitioning. 
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The second major feature of graphic functional modeling is that it can be used directly in 
existing computerized modeling programs. Thus, complicated system trades can be 
conducted at the functional level, before committing to a physical system design. 
Computerized modeling was. not necessary to successfully accomplish the task described 
herein; because of the ground rules and assumptions in Subsection 7.3, functional 
partitioning of the systems studied in detail was nearly automatic. If an airplane and 
airplane system were to be designed from the ground up, with no preconceived 
architectural rules, computerized functional modeling could prove to be very 
advantageous. 

The final structured specifications mentioned previously include data flow diagrams, data 
dictionary, and process descriptions. A data dictionary describes components and 
addresses redundancy questions using self-defining terms and easily understandable names. 
The process description is a minispecification that clarifies the identified functions. 

A high-level data flow diagram that illustrates the entire system showing the external 
interactions is called a context diagram. With this type of diagram, the major functions 
of the system and how they interrelate can be seen easily. Figure 6 shows the context 
diagram for the ACT system. 

The context diagram shows distribution of pilot inputs to high-level function groups. Data 
flow is indicated by the arrowed lines connecting the circles that contain the process 
functions. The high-level functions of the functions list appear in the context diagram 
along with the indicated data flow. 

The following major functional separations are indicated by the six shaded regions on the 
context diagram: 

• Region 1: information displays, status displays, and crew alerts 

• Region 2: autoflight systems, including autonavigation, guidance, and control 

functions 

• Region 3: thrust axis control 

• Region 4: airplane configuration changes for various flight phases 
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Figure 6. Context Diagr, 








• Region 5: attitude control and stabilization plus structural load relief 

• Region 6: interconnecting of the major functions controlling airplane dynamics 

Status feedback from the various airplane systems flows to the pilot through displays and 
alerts. Mechanical feedback (e.g., stick shaker) remains within the appropriate function 
group of the data flow diagram. The following functional grouping has been selected: 

• The crucial and primary control related functions are within the same group. 

• Control of thrust axis, which deals with speedbrakes and engine thrust, is a separate 
group. 

• Airplane, phase of flight, and configuration functions are a group. 

• Autonavigation and guidance, plus the automatic flight control functions, are 
considered to be workload relief functions and are expected to have a high level of 
integration. 

• Information and status displays, including alerts, form a single group. 

Figure 7 shows the data flow diagram illustrating the thrust axis control (3)*; Figure 8 
contains the airplane configuration changes for various flight phases (4)*; and Figure 9 
lists the autoflight systems, including autonavigation, guidance, and control functions 
(2)*. Figure 10 gives details of attitude control and stabilization plus the structural load 
relief functions (5)*. 

As shown in Figure 10, the pilot provides input via the column, wheel, and pedal 
deflections, etc., which, in conjunction with sensor input information, perform the 
indicated functions to generate the appropriate control surface signals. 


*These are the numbered regions on the context diagram (fig. 6). 
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Figure 10. Data Flow Diagram for the Control and Structure Load Relief Group 




) 


Pitch trim signal 









The ACT airplane exhibits negative stability characteristics over much of the flight 
envelope, and its longitudinal stability must be augmented by a pitch-augmented stability 
(PAS) function. 

The data flow diagram for the control and stabilize aircraft function (fig. 10) shows the 
process for PAS along with associated data flows. The Essential PAS function is also 
shown. The Essential PAS function is mandatory— the minimum acceptable pitch stability 
signal— and is required for continued safe flight. For this reason, Essential PAS is the 
basic building block to which all the other elevator signals are combined. The process 
description for this particular architecture would include details on redundancy, such as 
quadruple redundancy of a simple fixed-gain, pitch-rate feedback signal, with single signal 
selection techniques. Section 7.0 gives details of the process description. 

The Essential PAS signal is only one of the signals used to generate the elevator control 
signal that will drive the secondary actuator(s). The control signal is formed by adding the 
pitch attitude signal, the speed PAS signal, the short-period PAS signal, and the 
maneuver- load alleviation signal to the Essential PAS signal. This combining process 
must not degrade the Essential PAS function beyond the postulated function failure 
probability of 10 - 9. 

It is apparent that a family of suitable architecture designs can be derived from the data 
flow diagram and that selection of the best architecture will depend on a number of 
hardware requirements and software decisions. One useful application of the data flow 
diagram is to identify regions of difficulty as well as pointing to the proposed domains of 
change. Not only are low probabilities of failure important in the generation of the 
Essential PAS function, but they are also important in the signal selection, signal 
combining, and actuator control functions. 

In conclusion, the context diagram has provided an overview of the major functions. The 
individual data flow diagrams for each of these high-level functions illustrate the 
interrelationships of these data and the processes that make up the function. 








o 


7.0 SYSTEM ARCHITECTURE 

7.1 INTRODUCTION 


Development of Active Controls Technology (ACT) system architecture concepts is 
strongly influenced by the rapid growth and wide acceptance of digital avionics. 


The 1980s mark the beginning of broad commercial transport digital system application 
and evolution. Introduction of these extensive and complex digital systems may be even 
more significant for commercial than for military airplanes. Weight savings, improved 
reliability, design flexibility, and reduced maintenance are just a few of the digital system 
potential payoffs if the systems are rigorously developed. However, there are some 
hidden pitfalls along with the potential gains. 

The ACT airplane advances the current trend in commercial avionics toward more 
extensive, more interrelated, and more safety-critical avionic assemblages. Earlier 
airplanes compartmented design and test of avionic systems into functionally separate 
areas, with minimal concern for interaction among areas. The present generation of 
airplanes pushes the limit of complexity for such an approach. The various avionic 
equipment of any future airplane, such as ACT, must be designed as a single, integrated 
system, using techniques based on the lessons learned with current commercial airplanes 
and military and space programs. 


7.2 LESSONS LEARNED 


The present complexity of commercial airplanes, with all-digital flight management 
systems and other related digital systems, is rapidly equaling that of NASA and military 
space and air vehicles. Yet the commercial airplane manufacturers cannot accommodate 
the program and budget "elasticities" of military and NASA development and production 
projects. New airplane product delivery delays are not acceptable to customers, and 
budget overruns, although eventually paid by subsequent customers, are immediate 
burdens on the manufacturers. Consequently, budgets, schedules, safety requirements, 
and standardization requirements are met by maintaining traditional discipline separation, 
with systems integration becoming a concurrent design task. Thus, units within the 
avionic suite that must handle real-time integration of many interactive functions of 
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flight tend to require as much luck as acumen in their initial specification of size, 
throughput, and software volume. And the extensive differences between full field 
support for these new integrated digital systems and for older systems are just now being 
fully appreciated. 

The implications of digital interface requirements are now becoming apparent to those in 
the commercial airplane field who are using extensive digital avionics in new designs. 
Most of the earlier commercial airplane engineering and management experience has been 
with analog avionics and a few hybrid digital systems. The evolving magnitude of the end- 
to-end system cost (including costs for maintenance of automatic test equipment and 
software control) and the potential system interactions are slowly being recognized, along 
with the ultimate cost inherent in minimizing or deferring such considerations as: 

• Verification of system and software design by total system modeling 

• Comprehensive review of overall software system requirements 

• Software system configuration analysis 

• Testable and verifiable software requirements 

• Hardware and software end-to-end system interactions 

• Hardware and software mode hierarchy, mode regression, and reinitialization 

• Software coding to meet precise, verifiable system software requirements 

• Software intrasystem and intersystem verification and validation 

• "Cradle to grave" hardware and software configuration control by airplane tail 
number, and engineering analysis and simulation of impact of any software or 
hardware change prior to recertification 

Studies of software-intensive systems development (ref 17) have shown that 54% of the 
software errors are found during and after acceptance testing, as shown in Figure 11. 



Error category 


Incomplete or erroneous specification 
Intentional deviation from specification 
Violation of programming standards 
Erroneous data accessing 
Erroneous decision logic or sequencing 
Erroneous arithmetic computations 
Invalid timing 

Improper handling of interrupts 
Wrong constants and data values 
Inaccurate documentation 

Total 

Source: IEEE (ref 17). 


Total 


Number 


Percent 



28 

145 

12 

118 

10 

120 

10 

139 

12 

113 
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44 
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41 
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96 

8 
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100 


Figure 1 1. Software Error Sources and Categories 
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When discovered late in a program, the cost of correcting the errors can be extremely 
high. In addition, these studies have shown that 28% of the errors found during validation 
efforts were caused by incomplete or erroneous specifications. Also, this study showed 
that 12% of the errors were caused by intentional programmer deviations from the 
specifications. Experience has shown that software development time for the new digital 
avionic airplanes is substantially longer than initially anticipated. The embedded avionic 
software in a typical new commercial airplane is over 600 000 words. Considering that 
over 100 interacting computers can be tied together with many dedicated Aeronautical 
Radio Incorporated (ARINC) 429 digital unidirectional data buses, this becomes a problem 
of enormous software complexity. 

The electronic data processing industry, as well as the military and NASA organizations, 
has found by long and painful experience that there is no substitute for an early, extensive 
systems engineering approach to avoid confusion and delays downstream in a large 
program dependent on complex digital computer systems. If there is an inexpensive or 
simple solution to this complex problem, it is not apparent at this time. The task now is 
to develop the least costly way of doing the necessary front-end activity. Knowledgeable 
organizations are using structured analysis and vigorous systems engineering approaches 
that tend to cause heavy front loading in a program, with attendant initial time penalties. 
However, these approaches minimize program slippages during and after acceptance 
testing and certification and during inservice program phases. 

High-technology companies or organizations such as TRW, RCA, APL, and McDonnell 
Douglas Astronautics are beginning to use sophisticated computer program tools to 
generate testable, verifiable software system requirements. The software requirements 
tools must be used before coding software modules to correct the typical endless software 
recoding of modules, with the attendant patching and debugging that usually occur with 
open and incomplete specifications. One of these system program aids was prepared 
under contract with the U.S. Army Ballistic Missile Defense Command by TRW and is 
called Software Requirements Engineering Methodology. This program has been obtained 
from TRW by Boeing Aerospace Company and is hosted on a VAX 11/780 computer at 
Kent, Washington. This program has been used in research evaluations and appears to 
have a good potential for minimizing the traditional software development errors and 
resultant indeterminant program delays caused by software problems. 



In the past, commercial airplanes have not had the complex interdependency among 
systems that is now being experienced. The functional complexity and increased 
performance requirements have resulted from the need for better fuel economy, while at 
the same time operating in an increasingly complex air traffic system. This will 
eventually lead to four-dimensional (4-D) airplane performance requirements, with a 
precise time slot for takeoff to meet a preallocated landing slot and thus allow maximum 
fuel efficiency and system traffic capacity. Implementation of this concept on an 
airplane involves flight management systems integrated with essentially all other airplane 
systems from environmental control systems to electric power distribution. The payoffs 
in improved safety and fuel conservation warrant careful solution of these interface 
problems. 

The historical approach to certification involves certifying a functional capability with 
the related line replaceable units (LRU) in the airplane to provide for autopilot, 
autothrottle, autoland, autobrake, etc. The newer all-digital, complex interactive 
systems will of necessity cause reexamination of some of the older concepts in 
partitioning and isolation of functions. For example, a comprehensive flight management 
computer system in the new-generation airplanes has broad system ramifications, and that 
system along with the inertial reference system and air data computer system can have 
far-reaching impacts on the many LRUs in a fully digital avionic airplane. It will be a 
long— but very important— learning period for both industry and Government to apply the 
lessons learned in the new families of digital avionic airplanes and to apply the needed 
disciplines of structured analysis and systems engineering to the next generation of 
commercial airplanes. The necessary revisions to the basic approach will affect the 
entire industry and cause extensive changes to the old methods. The old "form, fit, and 
function" interchangeability criteria must be carefully reexamined, modified, and 
expanded to satisfy the requirements of a modern digital hardware- and software- 
configured airplane with complex, interdependent systems and LRUs. 

A systems methodology at a top level as applied to an ACT airplane is being developed to 
enable understanding this new approach and the software system implications therein. 
Previous experience then has shown that the development cycle for large, complex digital 
systems is costly, especially in software. In the future, software will be even more of a 
factor because the ratio of software-to-hardware cost is steadily increasing as shown in 
Figure 12 (ref 18). Also, there are some key concerns with developing software-intensive 
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systems. As mentioned previously, experience has shown that many software errors are 
caused by inadequate or poorly understood design requirements and specifications. In 
many cases, several iterations of "final" software packages are required before acceptable 
performance is achieved (fig. 13). As systems become more complicated, it becomes 
increasingly difficult for systems engineers or systems engineering groups to write an 
adequate initial specification without improved computer-aided systems methodology. If 
current inadequate system architectural design approaches were continued, private 
industry would have difficulty supporting the ever-increasing costs and finding the 
engineering resources to do the job. 

Another concern is the decline in productivity with software program size. Figure 14 
shows the effort required to develop a program from requirements to verified software. 
This indicates that the method of partitioning a system from a software point of view has 
a major impact on the required development effort, cost, and time. Therefore, software 
considerations should be the major driver in future system partitioning. 

The airplane system must be partitioned functionally and physically so that system 
specifications, coding, installation, and test are simplified and can be further supported 
with computer design tools. Furthermore, it is mandatory to keep the flight-crucial sub- 
systems small and simple because of their extremely stringent (and expensive) verification 
and validation requirements. 

Recent and projected developments in digital hardware processing capability will make 
this new system architecture practical. As described in Section 5.0, microprocessor 
hardware vendors are becoming more conscious of software problems and are helping to 
solve them by (1) providing major emphasis on software support, (2) designing for higher 
order language (HOL) implementation even at the silicon-chip level, (3) ensuring software 
transportability, (4) providing for modular expandability, and (5) building in many self-test 
and monitor functions in anticipation of user application needs. 

Because of the dense packaging, high processing throughput, and relatively low cost of the 
hardware, microprocessor capability in the future is less critical and can even be 
underused in many cases. This will permit a single microprocessor type to be used for 
both simple and complicated functions, thereby reducing the catalog of parts and the 
number of design and test tools required. 
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Figure 14. Software Productivity Trend for Program Size 
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7.3 ASSUMPTIONS AND GROUND RULES 

o 

7.3.1 ASSUMPTIONS 

As discussed previously, software complexity is the main driver for decentralizing the 
system functions, both in hardware and software. The subsequent increase in hardware 
complexity brought about by decentralizing the software is outweighed by design 
flexibility, ease of reconfigurability, simplified error detection, etc. But because of the 
large number of digital hardware elements, the digital data transmission system (ARINC 
429) used on current commercial transports is probably not practical. The ARINC 429 
system, which uses a separate bus for each data source, would impose too high a penalty 
in hardware complexity, weight, and installation cost. Many potential benefits of 
hardware modularization and software decentralization would be lost because of the 
inflexibility of intersystem and intrasystem wiring that is difficult to service, modify, or 
expand once installed on a large airplane. Thus, multiple-access, two-way digital data 
buses with autonomous terminals are assumed to provide the system data links. This data 
link differs from the MIL-STD-1533 link in one major respect: no bus controller is 

required because of the terminal's autonomy. A fault in the MIL-STD-1553A bus 
controller can result in failure of all terminals on the bus. A fault in a given MIL-STD- 
1553B bus controller requires additional complexity and overhead burden to permit 
reliable detection of a faulty bus controller and to provide successful bus controller 
transfer to one of the remaining good bus controllers. The autonomous data bus and 
terminal standard configuration envisioned in this study— and fundamental to the system 
architecture— has the potential for an active transmitter fault causing interference with 
other terminals on the bus. Because of this, these standard autonomous data bus 
terminals incorporate an independent monitor element to disable the transmitter if it 
violates protocol. Therefore, a central bus failure occurs only with a dual failure in a 
transmitter and its monitor or with a bus medium failure. Therefore, autonomous 
terminal failures will normally result in a shutoff of the elements the terminal services 
but will not affect other terminals on the bus. 

Analysis of total system performance, including effects of data rates, frame rates, 
transport delay, data freshness, and multiple digital sampling, is beyond the scope of the 
current task and is deferred to a later design phase. 

o 
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The decision to base system architecture on the Initial ACT Airplane configuration and 
upon the ACT Selected System configuration is another constraint. The 1990s ACT 
Airplane configuration and functions will no doubt differ from the Initial ACT 
Configuration. But the Initial ACT Configuration is representative of the ACT functions 
and criticality that would likely be in a 1990s ACT airplane. It is expected that the 
system architecture will evolve as the ACT airplane definition progresses, but changes to 
the ACT airplane configuration will not be the principal factor affecting system 
architecture decisions. The most important factors affecting those decisions will be 
unanticipated technology advances and performance, reliability, or maintainability 
deficiencies found by more detailed analyses and tests than have been possible during this 
high-level system study. A significant advantage to the top-down systems engineering 
approach applied to this study is that system deficiencies should not affect any level 
higher than the level in which they were found. 


Subsection 7.3 contains assumptions and ground rules for the system architecture study. 
Because of the limited scope of this study phase, some of the rules were not explicitly 
required but are presented for completeness in anticipation of further detailed study 
efforts. 

7.3.2 GROUND RULES 




The following ground rules are imposed as constraints on the architectural structuring of 
the integrated ACT/Control/Guidance System. 

7.3.2.1 General 


• The airplane configuration will be the Initial ACT Configuration, as defined in 
References 4 and 5. 


• All LRUs interchanging data via the autonomous, multiple-access, two-way digital 
data buses will use the same type of standard bus interface. 

• Loss of receiver function at any bus interface will not affect the other data link 
functions on the bus. 
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• For crew systems planning, the airplane will have a two-person cockpit. 


p 

• The ACT system configuration, used for integration with other avionic functions, will 
be based on the ACT Selected System (refs 6 and 7), except for the addition of fly by 
wire and deletion of flutter-mode control for a 1990s airplane. 

• Integrated ACT and avionic system configurations will be based on the supposition 
that the all-electric airplane will be practicable by the 1990s. 

• The Essential PAS function will be kept separate from integration of the other 
ACT/control/guidance functions. 

• Flight crucial functions must not be affected by failure of lower criticality functions. 
System functions will be grouped by safety criticality. 



• System design should preclude single-point failures (loss of function due to failure of 
a single system element). 

7.3.2.2 Sensors 


• Shared sensors will be used to the maximum extent practicable as constrained by a 
desire to isolate functions of differing criticalities. 

• Sensor redundancies will be driven by the most critical downstream functions. 

7. 3.2.3 Processors 

O Processing functions will be LRU separated, based on path or function criticality. 
This means that decentralized processing will be extensive, and multifunction 
processing in any single unit will be an exception to the design rule. 



Very few types of processing hardware units will be used, and they will be chosen to 
best satisfy the various processor applications (e.g., large number-crunching 
requirements, bit-processing requirements). 
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• With decentralized processing and few processor types, common software functions 
will be used extensively (allowing use of HOL library for configuration control and 
using a large-scale software development system for algorithm development and 
checkout and for compiling machine instructions). 

• System design will be based on the use of autonomous processing, to the maximum 
possible extent, together with careful consideration of the difficulties inherent in 
solving the data timing problems for interdependent, distributed function processing. 

7. 3.2.4 Actuators 


• Surface actuators will be shared among ACT and flight control functions to the 
maximum possible extent. This method of system implementation must ensure that 
actuation of functions of lesser criticality does . not affect functions of greater 
criticality. 

• It will be assumed that electromechanical actuators (EMA) and integrated electric 
motor hydraulic pump actuation packages of the requisite load and response 
capacities will be used in the 1990s ACT Airplane. 

7 . 3 . 2.5 Data Links 

• Multitransmitter, bidirectional, broadcast-mode serial data buses will be the standard 
for data interchange between LRUs. 

• Data links delivering data for system functions of greater criticality must be 
relatively "immune" from faults caused by system functions of lesser criticality. 




88 



7 A AUTOFLIGHT FUNCTIONAL MODES 


Structured analysis techniques were used to develop the candidate functional 
architecture, a context diagram of which is shown in Section 6.0 (fig. 6). A simplified 
variation of that diagram, shown as Figure 15, illustrates how the various processes are 
interconnected to perform four typical operational modes. Figures 16 through 19 show 
data flow paths for the manual mode, manual guidance with automatic control mode, 
automatic guidance with manual control, and automatic guidance with automatic control, 
respectively. The heavier lines show the major functional mode paths in each figure. 

The illustrated operating mode data flow diagrams do not delineate system physical 
architecture choices. The primary function of the diagrams is to ensure understanding the 
operating modes and to show that the modes do not differ from the data flows and 
processes of current-generation commercial transports at this high level. 



Figure 15. Simplified Context Diagram 
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Figure 19. Automatic Guidance With Automatic Control 
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7.5 HIGH-LEVEL PROCESS DESCRIPTIONS 


Figure 15 presents a simplified context diagram of the high-level functional processes and 
data flows required for airplane operation. The following subsections define the principal 
functional elements embedded in those processes. The system physical architecture 
decisions are still not affected by these intraprocess descriptions; the main purpose of the 
descriptions is to provide familiarity with the high-level processes. 

7.5.1 PRIMARY FLIGHT CONTROL PROCESSES 

Primary flight control processes are those processes normally associated with action by 
the pilot, such as inputs through appropriate movement of wheel, column, throttles, 
rudder pedals, trim, etc. 

For descriptive purposes, this subsection refers to the pilot's pitch axis command as a 
column deflection, while the pilot's roll axis command is termed a wheel deflection. This 
convention is taken to ease the descriptive task and is not meant to define the type of 
pilot input device or the type of input transducer (force or position). 

7.5.2 NAVIGATION, GUIDANCE, AND AUTOFLIGHT CONTROL PROCESSES 

At this functional level, it is appropriate to group the navigation, guidance, and autoflight 
processes into one generalized process because of their close interrelationship and for 
ease of understanding. When the processes are separated later, it will be found that 
similar functions might be performed in more than one process group; however, this is 
consistent with the assumptions and ground rules in Subsection 7.3. 

The navigation, guidance, and autoflight processes are composed of the following 
functions: 

Flight Management— Within the flight management functions, pilot-entered flight routes 
are defined and flight profiles are optimized and predicted. Automatic navigation is 
performed based on pilot entry and sensor data. Navigation and performance data are 
also available for display. 




o 



Flight Guidance-The flight guidance function provides thrust control and thrust limit 
determination. Guidance commands to acquire and track flightpath parameters (pilot 
selected and flight plan derived) are determined. 

Autoland Guidance— The autoland guidance function provides attitude control and landing 
path guidance through touchdown and rollout. 

7.5.3 PRIMARY CONTROL SYSTEM PROCESSES 

The primary control system accepts inputs from the primary flight controls (pilot) or the 
automatic flight control process functions to perform the following functions: 

Thrust Axis Control— Control of the throttles is directed from the primary flight controls 
or the automatic flight controls through the autothrottle actuators, but speedbrake 
control is accomplished through the primary control system by spoiler control. 

Airplane Configuration Changes as a Function of Flight Phase— The leading-edge slats, 
trailing-edge flaps, and landing gear comprise the equipment that configures the airplane 
for takeoff, cruise, and landing. 

Structural Load Relief— Relief of maneuver and gust loads is achieved by symmetric 
aileron deflections. The gust loads are also alleviated by flaperon movements. 

Airplane Attitude Control and Stabilization— Basic pitch, roll, and yaw controls are 
accomplished by elevator, aileron plus spoiler, and rudder variations, respectively. 
Modification of pitch, roll, and yaw characteristics changes the effective feel of primary 
pilot flight controls. Short-period and speed mode pitch-augmented stability is done by 
computing the appropriate control laws and providing signals for elevator control. 
Roll-yaw stability augmentation requirements are met by rudder control. 

7.5.4 AIRPLANE DYNAMICS AND ENGINE PROCESSES 

These processes include response of the airframe to control system deflections, response 
of the engine to throttle movement, and interaction of the airplane with the environment. 
Response and interaction are sensed by the sensor processes, and this information is used 
to complete the control loop back to the pilot or to the other system processes. 
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7.5.5 SENSOR PROCESSES 


Sensor processes include measuring or detecting wing and body motion, air data 
parameters, airplane control surface position, altitude, attitude and direction, instrument 
and microwave landing system signals, very-high-frequency omnidirectional range (VOR) 
and distance measuring equipment (DME) signals, engine performance variables, etc. 


7.5.6 INSTRUMENT AND DISPLAY PROCESSES 

The following indicators of flight conditions or system status are displayed: airspeed and 
Mach number, altitude, vertical speed, attitude (pitch and roll), engine thrust, direction 
(heading and track) turn rate, and time. 

Subsystem performance indicators (e.g., engine, hydraulics, and electrical) are also 
displayed. Navigation and guidance display functions are bearing and/or distance to 
navigation aids, bearing and distance to severe weather, deviation from selected landing 
system path, autoflight pitch, roll, airspeed, thrust commands, selected thrust limits, 
desired flight profile, airplane state (position and velocity), aeronautical chart data, and 
performance handbook data. 

The flight condition visual or aural alerts are overspeed, improper configuration, fire 
warning, autopilot disconnect, ground proximity, and ACT system faults. 

Abnormal status alerts are generated for the following systems: air-conditioning, 
autoflight control, electric power, fire protection, flight control, fuel, hydraulic power, 
ice and rain protection, instruments, landing gear, navigation, pneumatics, auxiliary power 
unit, doors, engine control, anti-ice, engine indication, oil, etc. 


Appendix C contains a more detailed tabulation of instruments and displays. 
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7.6 PRELIMINARY ARCHITECTURE 


Figure 20 is the high-level data flow diagram for the preliminary architecture. Only 
slight differences exist between this figure and the context diagram (fig. 15). These 
differences result from expansion of the primary control system process into its flight 
augmentation and flight essential components. The sensor process of Figure 15 now 
appears as sensors and processors. The navigation, guidance, and autoflight control 
processes are all included within the new navigation, guidance, autoflight control, and 
attitude management grouping in Figure 20. 

The bus structure for the preliminary architecture shown in Figure 20 is composed of four 
digital bus structures (A), (B), (C), and (D) and a dedicated (E) analog configuration. The 
sensor bus (A) contains data that are time critical and necessary for critical system 
functions. The data handled by the management bus (B) are non-time-critical data that 
provide control information and system configuration. The systems bus (C) contains time- 
critical data that are also provided at a constant update rate to perform mission-oriented 
and autoflight functions. The constant update rate actuator bus (D) provides the 
necessary data to command and feedback control the surface controllers and tactile 
attitude warning device (stick shaker). The analog, hardwired interconnections (E) handle 
the flight essential functions. Table 11 shows the preliminary architecture elements that 
make up the processes shown in Figure 20. These elements will be used in the following 
discussions. Subsection 7.6.2 describes the functions allocated to the elements. 

Descriptions of the five processor groups in Subsection 7.6.2 are purposely generalized. A 
definite candidate for these groups would be a micromainframe central processing unit 
(CPU), such as the Intel 432, that handles general data processing and a parallel array of 
input/output (I/O) processors to handle time-critical functions. Final selection of 
processor group architecture will require a detailed performance study of advanced digital 
hardware, and this information is only now beginning to appear in literature. 

7.6.1 OVERVIEW OF PRELIMINARY ARCHITECTURE 

This section describes allocation of system functions to elements and general 
interconnection of these elements in the preliminary architecture. In general, the 
architecture integrates the system functions by data buses, while separating those 
functions into smaller processing units. The concept is characterized by sharing sensors, 
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Table 1 1. Definition of Architecture Elements 


Architecture element 

Abbre- 

viation 

• Flight essential 


• Flight essential processor group 

FEPG 

• Dedicated sensors 


• Dedicated pitch gyros 

DPG 

• Primary flight controls 


• Pilot flight controls 

PFC 


Architecture element 

Abbre- 

viation 

• Control panels 


• Autoflight control panel 

ACP 

• Communication and navigation 

CNSP 

status panel 


• Multifunction panel 

MFP 

• Navigation, guidance, autoflight control. 


and attitude management 


• Autoland processor group 

ALPG 

• Flight guidance processor group 

FGPG 

• Flight management processor group 

FMPG 

•Display 


• Head-up display 

HUD 

• Attitude director display 

ADD 

• Flight instrument display 

FID 

• Horizontal situation display 

HSD 

• Engine display 

ED 

• System display 

SD 

• Sensors 


• Wing motion sensors 

WMS 

• Body motion sensors 

BMS 

• Air data sensors 

ADS 

• Surface position sensors 

SPS 

• Radio altimeter 

RALT 

• Instrument landing system 

ILS 

• Microwave landing system 

MLS 

• Pneumatic system 

PS 

• Engine sensors 

ES 

• Fuel sensors 

FS 

• Very-high-frequency omnidirectional 

VOR/ 

range and distance measuring 

DME 

equipment 


• Transponder 

XPOND 

• Processors 


• Air data processor 

ADP 

• Attitude processor 

AP 

• Flight augmentation processor group 

FAPG 

• Actuators 


• Autothrottle actuator 

A/TACT 

• Outboard aileron 

OB AIL 

• Inboard aileron 

IB AIL 

• Rudder 

RUDD 

• Elevator 

ELEV 

• Flaperon 

FLP 

• Spoiler 

SPOIL 

• Stabilizer 

STAB 

• Stick shaker 

STICK 





by decentralization of top-level functional processing among several computing elements, 
and by separation of functions by criticality. The result is an overall simplification of the 
system software by accepting greater hardware complexity. 

The groupings and interconnection aspects are preliminary at this time. Grouping is 
driven by criticality considerations and results in several system functions being 
accomplished through the joint effort of several elements. Although these function-split 
concepts appear to be theoretically feasible, more work will be required to specify the 
algorithms by element and the data transfer and timing aspects to the level required for 
concept verification. 

Figure 21 presents an overview of the preliminary system architecture. As described 
previously, the system is integrated by digital data buses; there are four different types in 
the preliminary architecture. The major sensor, management, and systems data bus 
interconnections are shown respectively in Figures 22, 23, and 24. These figures also show 
which elements receive data from the bus and which elements transmit data on the bus. 

Some general comments should be made about the architecture, which is based on the 
ACT Selected System for the Initial ACT Airplane with the addition of fly-by-wire 
functions and deletion of flutter-mode controls. All the primary control surfaces 
(elevators, ailerons, and rudders) are signaled through force voting secondary actuators. 
Two sets of secondary actuators in series generate a mechanical input signal to the power 
control actuator that moves the surface. One set of secondary actuators is dedicated to 
the basic control functions and the crucial pitch stability function (elevators). The 
remaining set of secondary actuators is dedicated to the other active control, 
augmentation, and automatic flight functions. The basic control secondary actuators are 
signaled over analog, hardwired links, while the other secondary actuators are signaled 
over digital data bus links. Secondary control devices (flaperons, stabilizer, spoilers, and 
stick shaker) are commanded on digital data bus links and do not use intermediate 
secondary actuators. The architecture is very sensitive to this assumed configuration. 

The sensors used by the crucial system functions, pitch gyros, and pilot control input 
sensors are also connected to the rest of the system through the sensor bus. Pitch gyro 
information can be used in the failure isolation process for the body motion sensor 
elements. Pilot control information is used by the augmentation and autoflight system 
functions. This interconnection must not affect the crucial functions. 
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The air data system includes a sensor group that puts raw measured data onto the sensor 
bus and a processor group to provide calibrated, computed air data. With this separation, 
the more critical functions can use the "raw” information directly or use it in a degraded 
operational mode if the air data computation function is lost. 

Similarly, the functions normally performed in a current ARINC 700 inertial reference 
system (IRS) have been separated into more than one element in the preliminary 
architecture. The basic inertial measurement functions have been allocated to the body 
motion sensors, which put data directly on the sensor bus. The more critical system 
functions can use these data directly. Attitude and orientation functions of the IRS are 
allocated to an attitude processor. Thus the source of more critical system data is 
separated from the source of less critical navigation data. This split is conceptually 
possible but will require some intermediate data transfer between the resulting separate 
elements. Details of the algorithms by element and the intermediate data transfer 
requirements must be developed in future study efforts. 

Because of the assumed configuration of the actuation system and manual flight control 
elements, the autoflight surface commands must be routed through the flight 
augmentation processor group (FAPG). The functions of the autoflight system are 
workload relief and economic enhancement. The principal exception to this is the 
Category III autoland capability. It is commonly assumed that loss of automatic attitude 
control from just prior to touchdown through the first portion of landing rollout in actual 
Category III conditions is catastrophic. Therefore, this portion of the autoflight 
system— the functions of vertical and horizontal landing path tracking, vertical path flare, 
and rollout lateral path guidance— has a much higher criticality than the other autoflight 
functions. If the principle is followed that functions should be separated by criticality, 
then these more critical functions should be separated from the other functions in the 
autoflight system. This is done with the autoland processor group. This group generates 
all control surface commands for the autoflight system and also provides guidance to 
track the landing path signals. Keeping these functions separate allows redundancy to be 
specified separately but makes the design more complex from a hardware standpoint. The 
rest of the autoflight system is based on the assumption that the guidance and control 
functions can be separated into distinct processors dedicated to specific outer guidance 
loops, each based on different time-scale dynamics. Again, the algorithms by element and 
required intermediate data transfer must be fully defined in later studies. In summary, 
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the architecture is preliminary and there are many areas where obvious improvements can 
be made. In addition, from a performance standpoint, feasibility work needs to be done to 
realize the benefits of partitioning. 

7.6.2 PRELIMINARY ARCHITECTURE FUNCTIONAL GROUPING 

This section presents an overview of the functions performed in each of the architecture 
elements. These descriptions are brief and are intended to allow understanding of the 
partitioning. Each element is listed followed by the description of the key functions 
performed. Descriptions of several elements are limited to those functions that take part 
in the high-level functions being addressed for the ACT/Control/Guidance System. Other 
supplementary functions that will certainly be part of the integrated avionic system are 
not discussed or shown. 

7.6.2. 1 Flight Essential Processor Group 

This group contains the flight essential processor and flight essential controller and 
performs the following: 

Basic Pitch Control— Basic pitch control deflects elevators proportional to pilot's control 
column deflection. In degraded operation, the proportionality ratio is a "default 
constant," which provides minimum acceptable handling qualities. In normal operation, a 
variable gain value is determined in and provided by the flight augmentation system. The 
actuator position is fed back to close the loop. 

Basic Roll Control— Basic roll control deflects ailerons proportional to pilot's wheel (or 
equivalent) rotation. The gain is either a default constant (degraded operation) or is 
provided by the flight augmentation system in normal operation (outboard aileron lockout 
accomplished by changing outboard aileron gain to zero). Actuator position is fed back to 
close the loop. 

Basic Yaw Control— Basic yaw control deflects rudders proportional to pilot's pedal 
position. The gain is either a default constant (degraded operation) or is provided by the 
flight augmentation system in normal operation. Actuator position is fed back to close 
the loop. 
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Basic Short-Period Pitch Stability— This function deflects elevators to stabilize 
short-period longitudinal mode based on pitch rate and pilots control column deflection. 
Control law gains are either constant (in degraded mode) or provided by the flight 
augmentation system in normal operation. 

7. 6.2. 2 Flight Augmentation Processor Group 

This group contains the flight augmentation processors and flight augmentation controller 
and performs the following: 

Modify Pitch Control Characteristics— This function determines elevator deflection versus 
control column gain to provide satisfactory feel characteristics throughout the flight 
envelope. The gain value is passed to the flight essential system. This function also 
deflects elevators and moves the stabilizer as necessary to provide desirable pitch axis 
characteristics throughout the flight envelope. 

Modify Roll Control Characteristics— This function determines aileron deflection versus 
wheel position gain necessary for good low-speed control while avoiding high-speed 
reversals. This function transmits this gain value to the flight essential system and also 
deflects the spoilers in relation to wheel rotation, autoflight commands, and flight 
conditions to augment roll response as appropriate for good control. 

Modify Yaw Control Characteristics— This function determines rudder deflection versus 
rudder pedal position gain necessary for good low-speed control while avoiding high-speed 
loads. Gain value is provided to the flight essential system. 

Enhanced Short-Period Pitch Stability— This function determines control law gains as a 
function of flight conditions for good performance of the short-period stability 
augmentation function throughout the flight envelope. Gain values are provided to the 
flight essential system. 

Speed Mode Pitch Stability— This function deflects elevators to stabilize speed longitudinal 
mode based on flight measurements. 

Roll-Yaw Stability— This function deflects rudders to stabilize Dutch-roll mode based on 
flight measurements. 


105 



Angle-of-Attack Limiting— Angle-of-attack limiting activates the stick shaker when flight 
conditions are close to stall and also deflects elevators to prevent the airplane from 
entering deep stall once the airplane begins to stall. 


n 


Wing-Load Alleviation— Wing-load alleviation deflects ailerons and flaperons to relieve 
gust and redistribute maneuver loads. It also deflects elevators to compensate for any 
pitching moment resulting from the change. 


Automatic Flight Control Commands— This function deflects ailerons, rudder, elevators, 
and spoilers in response to commands from the autoflight system. 

ACT Function Elevator Offload— This function generates stabilizer deflection signals to 
eliminate any steady-state elevator deflections commanded by the ACT functions. 

Pitch Trim— Pitch trim moves the stabilizer in response to pilot trim switch movements, 
autoflight trim offload commands, and ACT function elevator offload signals based on 
flight conditions and column position. 

7.6.2.3 Autoland Processor Group 

This group contains the landing guidance processor and attitude control processor and 
performs the following: 

Autoflight Attitude Control Loop— This function determines differences in desired and 
actual pitch and roll attitudes. Based on flight conditions and the autoflight mode 
provided by the autoflight control panel, it generates pitch and roll deflection commands 
to minimize differences. Autoflight commands are sent to the flight augmentation 
system. Desired pitch and roll attitudes are provided by either the landing guidance 
processor or the parameter guidance processor of the flight guidance processor group. 

Autoland Rudder Control— During automatic landing, the landing guidance processor 
provides a crab-angle correction to be nulled at the decrab point on the approach. Rudder 
commands are sent to the flight augmentation system. After touchdown, the rudder 
commands will be generated to null differences in the lateral landing path. 
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Autoflight Trim Offload— During automatic control modes, this function provides 
stabilizer trim commands to the flight augmentation system to minimize any steady-state 
elevator deflection. 

Autoland Path Guidance— During automatic landing modes, this function determines 
deviations from lateral and vertical final approach paths as defined by instrument landing 
system (ILS) or microwave landing system (MLS) signals and determines pitch and roll 
attitude commands to null the deviations. The attitude commands are given to the 
attitude control loop. During MLS curved or segmented approaches, path deviations are 
determined in the navigation processor of the flight management processor group until 
joining the final approach path segment. The flare vertical path guidance is also 
generated here. 

7. 6.2 A Flight Guidance Processor Group 

This group contains flight guidance processor, parameter guidance processor, and thrust 
control processor and performs the following: 

Autoflight Thrust Control Loop— This function determines differences in desired and 
actual thrust (engine pressure ratio or Nl) or specific energy rate input through altitude 
and speed (computed airspeed or Mach). It also determines autothrottle movement 
commands to minimize differences. The desired control parameter is determined by the 
autoflight system mode selected through the autoflight control panel. Autothrottle 
commands are sent to the autothrottle actuator and feedback commands returned to close 
the loop. 

Parameter Guidance— Parameter guidance determines differences in desired flight 
parameters (selected by pilot on autoflight control panel or via column and wheel 
deflections) and actual flight parameters. The flight parameter to be controlled depends 
on the autoflight operating mode also selected on the autoflight control panel. These 
differences will generate pitch and roll attitude commands to be provided to the attitude 
control loop of the autoland processor group (heading and track, altitude, speed, attitude, 
and flightpath angle). 
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Minimum and Maximum Speed Limiting— This function ensures that the autoflight system 
attitude and thrust commands do not violate minimum or maximum speed limits. These 
limits prevent autoflight operation near stall, beyond flap placard speeds, or above 
maximum operating airspeed or Mach. 

Flight Plan Guidance— This function determines differences in desired and actual paths. 
Desired path and actual data information are provided by the flight plan processor and the 
navigation processor of the flight management processor group. Based on the difference, 
this function computes heading and track, altitude, speed commands for the parameter 
guidance loop, and thrust control loop and provides optimization of commands as needed 
for total energy control. 

Limit Thrust Computation— Based on flight conditions (altitude, speed, and temperature) 
and, if applicable, any derating parameter, it computes continuously current thrust limit 
(engine pressure ratio or Nl) for each limit mode (takeoff and go-around, climb, 
continuous descent idle, approach idle, etc.). 

7 . 6 . 2.5 Flight Management Processor Group 

This group contains the flight plan processor, navigation data base, navigation processor, 
and performance data base and performs the following: 

Flight Route Definition— Based on pilot entry of airport name, route identifiers, departure 
and arrival standard instrument departures (SID), standard terminal arrival routes (STAR), 
airway identifiers, navigation aid and navigation point identifiers or latitude-longitude 
pairs, navigation aid fixes, etc., this function creates a sequential lateral waypoint flight 
plan. Data entry is made through the multifunction panel. Route and navigation aid 
locations are stored in the navigation data base. Altitude and speed (energy) constraints, 
if any, will be entered by the pilot or recalled (SID and STAR) from the navigation data 
base. 

Flight Profile Optimization— Based on performance data factors entered through the 
multifunction panel as well as performance modes (mininum cost and minimum fuel) for 
each vertical flight profile segment, the lateral flight plan with energy constraints, and 
current flight conditions, this function computes performance transitions and targets for 
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each performance leg. The optimized flight profile data are then available for use by 
flight profile prediction and the flight guidance processor. (The profile may be 
reoptimized during flight when needed on a non-real-time basis. If energy or time 
constraints or the lateral plan is changed, reoptimization would be performed.) Optimized 
profile data can also be used in the navigation display. The performance data base will be 
used. 

Flight Profile Prediction— Based on optimized flight profile, this function predicts energy, 
location, time, and weight (as appropriate) for each of the waypoints and performance 
transition points on the profile. This information can be shown on the navigation display. 
Computation will use the performance data base. (The prediction process may be used 
iteratively in the optimization process.) 

Automatic Navigation-Based on initialization data entered by the pilot through the 
multifunction panel, body axes precision accelerometer data, and data from the attitude 
processor, this function computes estimated inertial position and velocity. These values 
are combined with very-high-frequency omnidirectional range (VOR) and distance 
measuring equipment (DME) measurements to provide a best estimate of position and 
velocity. 

In MLS coverage areas, MLS angle and DME range data are combined with inertial data 
for the best velocity and position estimates. During MLS autoland operations before final 
approach, path deviation and deviation rate information are computed in compatible form 
for the landing guidance processor. 

In automatic guidance autoflight modes, control of VOR and DME radio tuning is 
exercised by the automatic navigation function with information from the navigation data 
base. Navigation estimated position and velocity are shown on the horizontal situation 
display. 

Navigation Data— This function provides a data base of airports, navigation waypoints, 
navigation radio aids, etc. Data are stored for navigation aids and waypoints, location, 
frequency, and identification. Route data consist of the sequence of waypoints associated 
with the airway, SID, STAR, etc., along with any speed or altitude (energy) constraints. 
Airport data may contain runway length, lighting, landing radio aid data, and terrain 
information. These data are used for flight plan definition, navigation display, and 
automatic navigation aid tuning. 
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Performance Data— This function provides a data base of airplane and engine performance 
information. The information is used in flight profile optimization and prediction and can 
be accessed to display equivalent "performance handbook" data such as optimum cruise 
altitude, endurance airspeed, engine-out driftdown speed, etc., for current conditions. 
Takeoff and landing data will also be available. 

7. 6.2.6 Pilot Flight Controls 

Primary Pitch, Yaw, and Roll Inputs— This function consists of transducers that respond to 
wheel, column, and rudder pedal position and analog data links to the flight essential 
processor group. Control position data are also put on the sensor data bus. 

Pilot Stabilizer Trim Input— This function detects pilot stabilizer trim commands. 
Commands are put on the sensor data bus. 

Pilot Throttle Input— Throttle positions are measured and transmitted on the sensor data 
bus. 

7. 6.2.7 Dedicated Pitch Gyros 

Pitch-Rate Sensors— Pitch-rate sensors are connected to the flight essential processor 
group via analog lines and are also connected through the bus terminal to the sensor data 
bus. 


7. 6.2.8 Wing Motion Sensors 

Accelerometers— Accelerometers are located at proper places in the wing to measure wing 
accelerations for the wing-load alleviation function. They are connected to the sensor 
data bus. 

7. 6.2.9 Body Motion Sensors 

Accelerometers and Rate Gyros— These gyros are located near the center of gravity (eg) 
to measure body rates and accelerations (inertial navigation quality) and are connected to 
the sensor data bus. Data are used throughout the system. 
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7.6.2.10 Air Data Sensors 


Total Temperature Probe-This probe measures total temperature of ambient air. It is 
connected to the sensor data bus. 

Angle-of-Attack Probe-This probe measures airplane angle of attack and is connected to 
the sensor data bus. 

Total Pressure-This function measures total pressure of ambient airflow and is connected 
to the sensor data bus. 

Static Pressure— This sensor measures static pressure of ambient air. It is connected to 
the sensor data bus. 

7.6.2.11 Control Surface Position Sensors 

Control surface position sensors (1) measure deflection of all elevators, rudder, and 
aileron surface segments; (2) measure deflection of all spoiler surfaces and trailing-edge 
flaps; (3) measure deflection of all leading-edge flaps and slats; and (4) measure deflection 
of the stabilizer. All sensors are connected to the sensor data bus. 

7.6.2.12 Radio Altimeter 

The radio altimeter measures altitude above the terrain and is connected to the sensor 
data bus. 

7.6.2.13 Instrument Landing System 

This system measures deviation from localizer course and glide slope and is connected to 
the sensor data bus. Station frequency is selected through the communication and 
navigation status panel through the management bus. 

7.6.2.14 Microwave Landing System 

This system measures deviation from runway centerline and glide slope. It also measures 
DME distance from the MLS station and azimuth and elevation angles relative 
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to it- This system is connected to the sensor data bus. Final approach glide slope can be 
selected within limits by the pilot on the autoflight control panel. Station frequency is 
also selected through the management bus. 


n 


7.6.2.15 Attitude Processor 


This processor uses body rate information from body motion sensors and Earth relative 
velocity information from the navigation processor to determine airplane attitude and 
true heading. Magnetic variation data stored in the navigation data base are used to 
synthesize magnetic heading. The attitude processor is connected to the sensor data bus 
and systems data bus. Orientation data are shown on the attitude director display and 
horizontal situation display. 

7.6.2.16 Air Data Processor 

The air data processor computes airspeed, Mach number, altitude, and altitude rate data 
using air data sensor measurements and body motion sensor measurements. It is 
connected to the sensor data bus. Computed data are shown on flight instrument displays. 
The processor uses barometric correction set by the pilot on the flight instrument display 
to compute barometric-corrected altitude. Altitude and altitude rate output are 
smoothed in a filter using vertical acceleration in normal operation. 

7.6.2.17 Autoflight Control Panel 


The pilot selects automatic flight modes through the autoflight control panel. These 
modes cover the spectrum from manual guidance and automatic control through 
automatic guidance and manual control (flight director) to automatic guidance and 
automatic control. Automatic control of the pitch, roll, and yaw axes as well as the 
thrust axis is engaged on this panel. In addition, various guidance modes are engaged on 
this panel ranging from tactical parameter tracking guidance to 4-D path-tracking 
guidance. Guidance parameter selections are made by the pilot on this panel. In addition, 
the active thrust limit mode is selected on this panel. The selected data are passed to the 
autoflight system on the management bus. 


o 
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7.6.2.18 Communication and Navigation Status Panel 


The pilot selects the frequencies of the communication and navigation radios through the 
communication and navigation status panel. Automatic tuning of VOR and DME by 
commands from the flight management processor group is also enabled, and the operating 
modes of the transponder and automatic direction finder (ADF) are controlled at this 
panel. Radio mode and frequency data are continuously displayed. 

7.6.2.19 Multifunction Panel 

The multifunction panel provides the interface to the pilot for initializing the navigation 
system and specifying the automatic flight plan and desired performance modes. Detailed 
performance data can be called up by the pilot on this panel. 

7.6.2.20 Transponder 

The transponder transmits an encoded response to air traffic control (ATC) surveillance 
radar interrogations depending on the mode activated by the pilot through the 
communication and navigation status panel. In the future, message information will also 
be transmitted and received during the interrogation and reply activity. The current 
transponder transmits an identification code and an altitude code to the ground station. 

7.6.2.21 VOR and DME 

VOR and DME measure bearing to and distance from the selected ground station. The 
station is selected manually by the pilot through the communication and navigation status 
panel or automatically in automatic navigation modes through the flight management 
processor group. 

7.6.2.22 Pneumatic Sensors 

Pneumatic sensors provide status of airbleeds or demand on engine system from 
pneumatic systems (anti-ice, pressurization, air-conditioning, etc.). The information is 
used to determine limit mode thrust settings and to calculate optimum performance 
profiles. 
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7.6.2.23 Engine Sensors 


Engine sensors measure engine pressure ratio, revolutions per minute of rotors, gas 
temperature, etc. 

7.6.2.24 Fuel Sensors 

Fuel sensors measure fuel flow and quantity remaining in fuel tanks. 

7.6.3 PRELIMINARY ARCHITECTURE DATA INTERFACES 

System interface requirements are best understood by analyzing the data transfer 
between system elements. The data interfaces are limited to those items required to 
perform the top-level ACT/control/guidance functions as scoped in Subsection 6.1. 
Therefore, a large number of data items that will be part of the total integrated avionic 
system are not considered here. Three different methods of presentation are used. The 
first method is to tabulate the data items appearing on a data bus by the element that is 
the source of the data. Table 12 presents the data flow onto the sensor data bus. 
Table 13 shows data flow onto the systems data bus. Table 14 presents management data 
bus items. When large data processing elements are to be examined, a second method is 
used that shows the major processor elements as "sinks*' and "sources" of data. Figures 25 
through 30 present data transfer information organized in this way, with arrows indicating 
major data flow. 

Finally, the data interfaces are described by showing the elements required to perform 
the high-level functions. Previously, output from the top-down analysis of the airplane 
functional requirements was presented (sec 6.0) as a list of high-level functions in tabular 
form. The data interfaces for most of these high-level functions now appear in Figures 31 
through 53. As an example, the function "modify pitch control characteristics" is 
presented as Figure 35. These single-thread diagrams are useful when determining how 
the architecture will perform a particular high-level function. 
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Table 12. Sensor Bus Data Items 



Sensor bus 
interface 

Bus data item 

Engine 

Airmass flightpath angle 
Pressure altitude (smoothed) 
Barocorrected altitude (smoothed) 

Engine pressure ratio (EPR) 

sensors 

Low-speed-rotor speed (N1) 

Attitude 

Pitch attitude angle 

processor 

Roll attitude angle 

Pitch attitude rate 
Roll attitude rate 
Magnetic heading 
True heading 
Heading rate 


Sensor bus 
interface 

Bus data item 

Pilot flight 
controls 

Column deflection 
Wheel deflection 
Rudder pedal deflection 
Stabilizer trim command 
Throttle position 

Dedicated 
pitch gyros 

Pitch rate 

Wing 

motion 

sensors 

Wing acceleration 

Body 

motion 

sensors 

Body accelerations 
X acceleration 
Y acceleration 
Z acceleration 
Body angular rates 

Angular rate about X axis 
Angular rate about Y axis 
Angular rate about Z axis 

Air data 
sensors 

Indicated static pressure 
Total pressure 
Total air temperature 
Indicated angle of attack 
Indicated impact pressure 

Surface 

position 

sensors 

Elevator segment deflection 
Aileron segment deflection 
Rudder segment deflection 
Spoiler panel deflection 
Trailing-edge flap segment deflection 
Leading-edge flap and slat segment 
positions 

Stabilizer deflection 

Radio 

altimeter 

Height above terrain 

Instrument 

landing 

system 

Localizer deviation 
Glide slope deviation 

Microwave 

landing 

system 

Azimuth deviation 
Elevation deviation 
Range to station 
Azimuth angle 
Elevation angle 

Air data 
processor 

Airspeed 

Corrected angle of attack 
True airspeed 
Mach number 
Altitude rate (smoothed) 
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Table 13. Systems Bus Data Items 


Sensor bus 
interface 


Bus data item 


VOR/DME 


Bearing to station 
Range to station 


Pneumatic 

sensors 


Airbleed status (on /off status of 
systems with significant bleed air 
demand) 


Fuel system 


Fuel flow rate 
Total fuel quantity 


Autothrottle Autothrottle position 

actuator Autothrottle actuator rate 


Autoland Elevator deflection command 

processor group Roll deflection command 

Rudder deflection command 
Stabilizer trim deflection command 


Flight guidance Guidance pitch reference 

processor group Guidance roll reference 

Autothrottle command 


Flight 

management 
processor group 


Flight plan 
Current track 
Current airspeed 
Current thrust mode 
Current altitude 
Flight plan 
Next track 
Next airspeed 
Next thrust mode 
Next altitude 
Flightpath angle 
Acceleration along flightpath 
Acceleration normal to flightpath 
Ground track 
Ground speed 
MLS path deviation-lateral 
MLS path deviation— vertical 
MLS path distance 
Vertical acceleration 
Cross-track acceleration 
North velocity 
East velocity 
Latitude 
Longitude 

Along-track acceleration 
Wind speed 
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Table 14. Management Bus Data Items 



Management 
bus interface 

Bus data item 

Autoflight 
control panel 

Selected runway heading 
Selected MLS glide slope 
Selected maximum bank angle 
Selected autoflight mode 
Selected heading and track 
Selected airspeed and Mach No. 
Selected limit thrust mode 
Selected thrust derate 
Selected altitude 
Selected flightpath angle 

Multifunction 

panel 

Interactive navigation initialization data 
Interactive flight plan definition data 
Interactive performance mode definition 
data 

Interactive prediction and performance 
data requests 

VOR/DME 

Tuned station frequency 

Instrument 
landing system 

Tuned station frequency 

Microwave 
landing system 

Tuned station frequencies (MLS and DME) 
Reference glide slope angle 

Communication 
and navigation 
status panel 

VOR/DME selected frequency 
ILS selected frequency 
MLS selected frequency 
Transponder mode select 
Transponder identification code select 
VHF communication selected frequency 
HF communication selected frequency 

Baroset control 

Barometric altimeter setting 

Flight 

management 
processor group 

Interactive navigation initialization 
requests 

Interactive flight plan definition requests 

Interactive performance mode definition 
requests 

Interactive prediction and performance 
data 

Magnetic variation 

Autotune VOR/DME selected 
frequency 

Transponder 

Operating mode 
Identification code 
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Wheel position, 
column position. 


Pilot 

flight 

controls 

stabilizer 

trim command ^ 



Pitch rate, 
yaw rate, 

normal acceleration 

Body 

motion 

sensors 




Air data 
sensors 

Impact pressure 



Angle of attack, 

Mach number, 
altitude, true airspeed, 
airspeed 

Air data 
processor 



Wing 

acceleration ^ 

Wing 

motion 

sensors 



Flap deflection, 

LE flap and slat position, 
stabilizer deflection w 

Surface 

position 

sensors 




Attitude 

processor 

Roll attitude 







Figure 25. Flight Augmentation Processor Group Data Transfer 
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Figure 26. Autoland Processor Group Data Transfer 
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Guidance commands: 



Figure 27. Flight Guidance Processor Group Data Transfer 
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processor 
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Figure 28. Flight Management Processor Group Data Transfer 
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Figure 29. Air Data Processor Data Transfer 
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Body pitch rate. 



Figure 30. Attitude Processor Data Transfer 
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Figure 33. Change Roll Attitude, Using Wheel Deflections to Ailerons 
Through Essential Processor and Through Augmentation 
Processor to Spoilers 
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Figure 34. Change Sideslip Angie via Rudder Deflections, Using Rudder 
, Pedals 








Figure 35. Modify Pitch Control Characteristics 
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Figure 36. Modify Roll Control Characteristics 
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Figure 43. Display Airspeed and Mach, Altitude, and Vertical Speed 



Figure 44. Display Engine Thrust 




Figure 45. Display Attitude, Pitch and Roll, and Direction 
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Figure 46. Display Bearing and/or Distance to Navigation Aids 




Figure 47. Display Deviation From Selected Landing System Path 
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Figure 48. Communications 
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Figure 50. Capture and Maintain Flight Parameters (Including Minimum Speed 
and Maximum Speed) 
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Legend: 

C ^ Items used by FGPG 

Figure 51. Capture and Track Landing System Path 
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Figure 52. Provide Flight Parameter Targets To Follow Optima! Flight Profile 




Figure 53. Determine Airplane Position and Velocity 




7.6.4 ALTERNATIVES TO PRELIMINARY ARCHITECTURE 


This section discusses alternatives to some of the designs and approaches shown in the 
preliminary architecture. Qualitative effects of the alternatives on the preliminary 
architecture are described to point out some of the obvious benefits and limitations. 

The assumed actuator interface strongly influences the architecture. In the preliminary 
architecture, each elevator, rudder, and aileron surface has three sets of redundant 
actuators. The physical complexity of this configuration is significant. The fundamental 
problem in the Initial ACT Configuration actuator interface is how to share the control 
surface between the crucial manual control functions, the critical active control 
functions, and the workload relief autopilot functions. This sharing must be done so that a 
malfunction in a less critical function does not jeopardize the more critical functions. 

In the preliminary architecture, separation is performed by using basically one set of 
secondary actuators for the crucial functions and another set of secondary actuators for 
the critical and workload relief functions. Both sets of secondary actuators provide inputs 
to the power actuators that deflect the surfaces. The secondary actuators for the less 
critical functions will have limited authority compared with the actuators used for crucial 
functions if the requirements of the specific functions involved permit this. 

A method for combining surface deflection commands from sources of different 
criticality must be found if the secondary actuators are to be eliminated. This method 
must provide the same subsystem integrity and level of fault tolerance as that of the 
secondary actuators. In the replacement system, the combining function (which would 
include fault checking or voting) probably would be performed in an element of the most 
critical subsystem. Therefore, eliminating the secondary actuators requires adding 
processing functions to the more critical system. The replacement method would require 
a thorough development effort because of the criticality of the functions involved. 

The crucial functions of the preliminary architecture are implemented in the flight 
essential system. To provide a "get home" capability, these functions use basic control 
laws that operate with a fixed gain and with a minimum number of inputs. Keeping the 
system processing limited and well isolated from other functions is an attempt to simplify 
the system design and ease the difficulty of the verification and validation effort. With 
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this approach, a generic fault in the crucial system can lead to loss of the airplane. 
Therefore, generic faults must be eliminated from the crucial system during development 
prior to flight test. 

An independent backup system is an alternative design that would somewhat alleviate the 
generic failure concern. The existence of the backup system should in no way reduce the 
crucial system design, development, and verification effort. The backup system might 
only be installed for the duration of the flight test effort, and it might be removed after 
certification of the crucial system. Therefore, it should be designed so that its removal 
has no effect on the rest of the system. The backup system would provide basic get-home 
flight control capability. The problem introduced by the alternative design is how to 
switch control from the normal system to the backup system. The switching would take 
place only to prevent a catastrophic occurrence, and the probability of false alarm 
switching must be insignificant. To satisfy these requirements, an intelligent switching 
function or system monitor is necessary. 

In an installation requiring a backup system, the status of the backup system would 
influence flight dispatch. Loss of capability would cause dispatch refusal or flight 
diversion. If the backup system were always in an active status, the system monitor could 
be used to check system status. With this feature, the monitor would listen to the input 
and output data for both the essential system and the backup system. The monitor would 
provide a signal to switch actuator command control from the essential system to the 
backup system in the event of failure. 

With incorporation of a simple backup system, the design rules for the essential system 
might be modified. The essential system could be upgraded to perform all normal modes 
of the top-level crucial functions. This would require additional sensor input data and 
more data processing in the essential system. In addition, the essential system would have 
to incorporate degraded mode capability to handle the loss of noncritical sensor data. 

This increase in essential system functional effort would eliminate the interface between 
the essential and augmentation systems. Figure 54 shows the alternative approach. 
Incorporation of a backup system presents a major design challenge. The crucial 
switching function is in itself suitable for a separate development effort. 




Flight essentia! 
system 

Figure 54. Backup System Configuration 


The actuator interface for the rudder surfaces is identical to that for the elevator and 
aileron surfaces in the preliminary architecture. However, criticality analysis of the 
top-level functions indicates that yaw control is not as crucial as roll and pitch control 
from a safety standpoint. With this in mind, manual control of the rudder could be 
reallocated to the augmentation system from the essential system. The actuator 
interface for the rudder would be simplified by eliminating the secondary actuators. The 
change would simplify the actuator interface and the computing functions of the essential 
system but would require adding more computing functions to the augmentation system. 

The preliminary architecture presented earlier does not use "smart" actuators. Only 
signal conditioning and digital bus interface functions are mandatory at remote locations 
in the preliminary architecture. With a "smart" actuator, some system intelligence is 
located in the harsh environment of the actuators. Not only is the environment for this 
intelligence more difficult than that of the normal electronics equipment bay, but its 
accessibility for maintenance is degraded. Currently, development efforts are under way 
to relieve these concerns. Local intelligence at the actuator can be used to close servo 
loops and perform some levels of fault tolerance at the actuators. These functions could 
use redundant feedback sensors on the actuator and suitable computation and selection 
logic at that point. The "smart" actuator could also use multiple, ruggedized 
microprocessors to provide redundant internal loop closure computation and response. 
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Data processing functions are shared extensively in the preliminary architecture. In the 
same way that top-level functions share sensors and actuators, outputs of certain common 
data processing functions are also shared. Processes such as calculating airplane attitude, 
airplane speed, and surface deflections necessary to automatically maintain attitude are 
performed at one location in the system. The criticality of these shared processing 
functions is therefore determined by the most critical top-level function. 

An alternative would be to duplicate these common data processing functions in each 
top-level function. In this approach, the attitude display function would calculate 
attitude independently of the attitude calculation for the autopilot functions. This 
nonshared alternative leads to subsystems that are more autonomous at the price of 
duplicated processing functions throughout the system. Final or intermediate results of 
top-level functions would not be shared with other top-level functions. The nonshared 
alternative requires each subsystem to perform more data processing functions and 
increases the relative size of the subsystems. The additional design and verification and 
validation effort implicit in this alternative might be alleviated if common software 
functions could be maintained in a library and implemented in subsystems separate from 
the library. This also implies compatible— if not identical— computing hardware. Figure 55 
shows an example of the alternatives. 

In the preliminary architecture, the ARINC 700 inertial reference system functions are 
partitioned into three elements: body motion sensors, attitude processor, and navigation 
processor. The motivation for this split is that the inertial reference system typically 
serves several top-level functions that have different criticality ratings. Design ground 
rules and redundancy can be specified separately for the three element types as necessary 
to meet the reliability requirements of the top-level functions. The body motion sensor 
element measures pitch-rate information needed by the crucial functions. Splitting the 
functions means qualitatively an increase in reliability and decrease in cost for obtaining 
just the pitch rate compared to an integrated inertial reference system. An alternative 
design that would take further advantage of the partitioning would use the body motion 
sensors for pitch rate, thereby eliminating the need for the dedicated pitch gyro type of 
LRU. The body motion sensor element must then satisfy the reliability requirements of 
the crucial pitch stability functions. Comparative life cycle costs would play a large role 
in evaluating the desirability of the alternative design. 
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Figure 55. Data Processing Function Alternatives 

The autoflight attitude control loop is functionally and physically separated from the 
autoflight thrust control loop in the preliminary architecture based on criticality 
considerations, A study (ref 19) has shown that functionally integrated approaches can 
greatly simplify the autoflight system design as well as improve performance. 
Specifically, the natural coupling between the pitch axis and thrust axis can best be used 
by controlling them together rather than separately. One alternative would be to 
compute both controls in the same physical location. However, this would combine the 
less critical thrust control loop with the more critical (due to autoland) attitude control 
loop. This would increase the amount of functional processing and fault-tolerant overhead 
processing in the inner loop element and increase the related design and verification and 
validation effort. Another alternative would be to maintain physical separation but 
functionally integrate the two loops by data bus information transfer. This would require 
adding degraded mode behavior provisions (at least in the more critical element) to allow 
function survivability if the other element fails and would impact data bus information 
rates and overall loading. The choice of method would require further definition and 
comparison. 
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In the preliminary architecture, crucial function surface deflections are commanded by 
the flight essential processor group and the other surface deflections are commanded by 
the augmentation processor group. Therefore, all autoflight commands must be routed 
through the augmentation processor group. This allows some computational sharing (e.g., 
the wheel deflection to spoiler deflection is shared between the autoflight and manual 
control functions) but results in less autonomous subsystems. In this configuration, 
integrity of the more critical functions is preserved at the cost of having the more 
critical elements perform some fault checking overhead functions on the inputs from the 
less critical elements. 

Two alternative design approaches could be taken with respect to this configuration. In 
the first alternative, the autoflight system inner loops would generate the equivalent of 
pilot control commands, which would use the same computation function as the manual 
flight control function to generate surface deflection commands. This would necessitate 
an autoflight input interface (along with fault-tolerant overhead processing) every place 
where the manual flight control commands are computed. This alternative would 
completely eliminate any need for secondary actuators for the autoflight functions and 
would exhibit maximum sharing of common processing functions. 

The other alternative would allow the autoflight inner loops to independently calculate 
surface commands and directly signal the actuation interface. The command to surface 
deflection transfer function would have to be duplicated in the autoflight control 
elements and the manual control elements. This second alternative leads to a more 
autonomous autoflight subsystem. Both approaches would increase the amount of 
processing required in the more critical systems. In the first alternative, additional 
overhead processing would be necessary to ensure that an erroneous autoflight command 
would not jeopardize the pilot's capability to control the airplane. With the second 
alternative, a command combiner element with fault-tolerant characteristics is necessary 
so that autoflight-commanded surface deflections do not compromise the more critical 
airplane stability and control functions. Figure 56 presents a schematic of these 
alternatives. 

In the preliminary architecture, an operative ground rule was that any element could 
receive data from any data bus but elements of lower criticality could not transmit on a 
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Figure 56. Surface Signal Consolidation 








bus containing more critical data. This ground rule is based on characteristics of the 
autonomous access data bus envisioned in this study. This bus incorporates a terminal 
with an independent monitor element that disables the transmit function if it violates 
protocol. Because of this aspect, the central bus failure modes are limited to failure of 
the bus medium and a dual monitor and transmitter failure. Therefore, a connected 
element affects integrity of data transfer among other elements on the bus only by its 
transmit function. 

Because the likelihood of a dual failure at a terminal is very low, connection of another 
transmitting element to a bus will have only a small decremental effect on data transfer 
function reliability. Therefore, it could be argued that the ground rule used in the 
preliminary architecture was too restrictive. Because standard terminals are used 
everywhere, connecting lower criticality elements to a bus does not significantly lower 
critical function reliability. 

The navigation functions are grouped primarily with the flight management system in the 
preliminary architecture. This grouping has several disadvantages. First, it is obvious 
that the flight management system has been allocated a large amount of data processing. 
In addition, some of the navigation functions are more critical than the typical workload 
relief functions performed in the flight management system. For these reasons, an 
alternative would be to separate the navigation-related functions from the flight 
management system. In an alternative configuration, the navigation function would be 
performed in two elements based on criticality. One element would provide the basic 
inertial position data and resolved acceleration data used throughout the system. The 
other element would perform the other navigation functions such as combined sensor 
automatic navigation and automatic tuning of radio navigation aids. The second element 
would also contain the navigation data base. The alternative would lead to a more logical 
system organization but has the disadvantage of increasing the number of LRU types in 
the system. 
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7.7 SYSTEM REDUNDANCY 


7.7.1 REDUNDANCY CONCEPTS 

7.7. 1.1 Basic Redundancy Needs 

The integrated ACT/Control/Guidance System performs several top-level functions that 
are critically important to the safety of the airplane. These functions must survive the 
failure of any units in the system. Subsection 6.2 evaluated the top-level functions for 
safety criticality. In addition to safety, there are other reasons why top-level functions 
must be survivable on commercial aircraft. Airline spare-part inventories and logistic 
system costs require the airlines to stock extensive spares only at a few of their line 
stations. Consequently, any function required for dispatch or important for economical 
operation must either be very reliable or survivable enough to allow dispatch with a failed 
unit. Otherwise, unit failures would lead to costly flight delays or would adversely affect 
airline profitability on the route segment. Thus, often an incentive exists from a cost 
benefit point of view for an airline to specify survivability greater than that required 
from a safety point of view. 

7.7. 1.2 Redundancy Configuration Overview 

Survivability is accomplished by having an alternative way to perform the top-level 
function. The alternative way can be a backup system using one or more different units 
than the primary system. Most conventional avionic systems provide the alternative way 
by replicating the units performing top-level functions. Use of identical redundant units 
has obvious life cycle cost benefits. However, a weakness of the conventional approach is 
that the top-level function is susceptible to common hardware failures, common software 
faults, or design errors in the identical units. Therefore, generic failures must be 
rigorously eliminated to the maximum extent possible, before operational certification, to 
provide survivability with this approach. 

Conventional avionic systems were developed from a tradition of rigidly isolated 
subsystems (where feasible) dedicated to performance of certain top-level functions. This 
guarantees that faults in one subsystem do not affect performance of another subsystem's 
functions. Recent trends toward increased performance and a desire to lower initial and 
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life cycle costs have led to much more integration in the system. To provide the same 
fault isolation with integration, it is necessary to carefully partition the system hardware 
and software so that faults do not propagate across partition interfaces. 

A redundancy configuration that uses the traditional concept employs redundant units in 
separate channels, which are kept isolated. Each unit in the string necessary to perform 
the function is replicated to provide a complete redundant channel that can independently 
perform the function. In each isolated channel, there is only one data* path through the 
channel. A method is required to select the channel providing the function or to combine 
redundant channels into a single output. 

In the isolated-channel configuration, the least reliable unit dictates the number of 
channels necessary to meet the reliability requirement. Units with high relative 
reliability have the same redundancy as the less reliable units but do not significantly 
improve reliability of the overall system. 

A configuration with cross-channel communication allows redundancy to be specified on a 
unit-by-unit basis. With this configuration, multiple data paths allow units to 
communicate with redundant units from other "channels" to perform the function. 
Figure 57 shows the multiple data paths. With an isolated-channel configuration, failure 
of a unit effectively disables all the units in its channel; while with cross-channel 
communication, the processes performed by a failed unit are performed by a redundant 
unit in another channel. However, cross-channel communication requires more complex 
methods to determine the units that are healthy and that should perform the top-level 
function. The methods or' techniques for determining unit or channel status and directing 
participation of units or channels are discussed in Subsection 7.7.2. 

7.7.2 REDUNDANCY MANAGEMENT 

Redundancy management methods accomplish three major tasks: failure detection, 

failure identification, and system reconfiguration. Failure detection determines that 
there has been a failure in the system. Failure identification determines which specific 
unit has failed. Finally, system reconfiguration organizes the remaining good units to 
perform the top-level function. Redundancy management schemes range from simple 
methods performed by the crew to complex automatic schemes that in themselves may 
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Figure 57. Isolated -Channel and Cross-Channel Communication Configurations 


require more hardware and software than the functions they protect. Because of the 
potential for the redundancy management overhead functions to greatly burden the basic 
functional design, care must be taken to ensure that more complex methods are used only 
where they are absolutely necessary. The complexity of redundancy management should 
be based not only on the safety criticality of the function being performed but also on the 
critical time history, or rate of divergence of the system behavior when a failure occurs. 
For example, a function whose failure causes an immediate loss of airplane control 
requires a more complex redundancy management method than a function failure that is 
obvious to the crew members and leads to a serious consequence only after a significant 
period of time. Simple redundancy management using the crew members should be used 
where possible, because the crew can detect and identify failures by cross-checking 
displayed flight conditions or system status indications and then reconfigure with cockpit 
switches or controls. Allocating suitable redundancy management functions to the crew 
greatly simplifies the system design. Accordingly, this allocation must be performed in 
conjunction with crew roles, procedure definitions, and workload analyses to ensure 
compatibility of these special tasks. 
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Automatic redundancy management methods are typically complex, with a large overhead 
burden, to meet stringent performance requirements where necessary. Therefore, 
automatic methods present the greatest challenge to the system designer. Proper 
application of these methods is necessary to achieve the goal of a cost-effective design 
that meets requirements. The remainder of this section covers categories of these 
automatic methods. 

7.7.2. 1 Inline Monitoring 

Automatic methods for detecting system failures range from inline internal hardware 
monitoring to comparison of the external outputs of the redundant units. With inline 
monitoring, the hardware elements in the system units are continually self-tested for 
proper behavior. Failure detection and identification occur when an element fails the 
test. The specific self-test design is based on the function of the hardware element being 
checked. A more extensive functional self-test method can be used to detect faults. In 
this method (stimulus and response), an input test signal pattern or sequence drives the 
unit or string of units. If the unit does not respond properly, it is declared faulty. 
Designing functional tests that can detect the significant and most probable faults is a 
challenging task. Functional self-test methods are currently used in preflight or 
preengage operations. 

7.7.2.2 Output Comparison 

In the external output comparison method, outputs of the redundant units are compared to 
determine when a failure occurs. Detection takes place when the outputs of the similar 
units differ by more than some threshold amount. The threshold values are selected by a 
compromise between false alarm probability and missed alarm probability. The most 
straightforward application compares outputs of identical units. A more complicated 
output comparison method uses a model of the system and its environment to derive a 
signal for comparison of outputs from one or more units. 

The reasonableness checks method is a very simple model approach. A unit output value 
or the rate of change of the value can be compared with fixed limits that are based on 
whether the value or its rate of change is reasonable or physically realizable. If the 
output exceeds the limits, the unit is considered faulty. More extensive system models 
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can use other sensed information to determine the best estimate of a parameter, which is 
compared with a unit output. Methods that detect and identify failed units by comparing 
derived parameter values with techniques such as Kalman filters have the advantage of 
requiring fewer identical units for fault identification. Of course, a tradeoff occurs 
between the decreased life cycle costs for a system with fewer redundant units and the 
increased development costs for the more complex redundancy management. More 
sophisticated modeling methods using advanced estimation techniques can be used to 
create very high performance failure detection and identification elements. 

7.7.2.3 System Reconfiguration 

The final redundancy management task is system reconfiguration to perform the top-level 
functions after a failure. Replacement of malfunctioning elements can take place on a 
channel basis or on a unit-by-unit basis. To reconfigure on a channel basis, only the failed 
channel needs to be identified; while with unit replacement, the specific unit must be 
identified. Some of the detection methods discussed previously have a built-in way to 
identify the failed unit. With channel replacement reconfiguration, redundancy 
management does not need to perform the failed unit identification task. Once a failure 
is detected, the channel is shutdown or deactivated. 

For actuation functions, channel replacement can be accomplished by actuator force 
voting. This method uses the differential force generated between the good and bad 
channels to mechanically overcome or disengage the faulty channel. Redundancy 
management logic can also perform channel replacement by switching a bad channel off 
the line or switching a standby channel into control. 

System redundancy is used most efficiently when individual units can be effectively 
replaced. The interunit selection method accomplishes this for sensor and processor units. 
In this method, outputs of a redundant unit are used to replace the outputs of a failed unit 
using cross-channel communication paths. If a unit is declared faulty, outputs from a unit 
in another "channel" are used to supply the downstream units in the channel with the 
failed unit. 

As mentioned before, unit replacement requires identification of the failed unit. When 
output comparison methods are used for failure detection, identification is usually done 
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with voting. Voting requires three sources of information, with the faulty source being 
identified by majority rule. 

Signal selection is a method that continuously selects between redundant units on an 
individual signal basis. In this method, outputs of all redundant units are compared and 
one signal is passed for use by all downstream system units. This signal can be the signal 
from a specific unit or a composite of the signals from all of the good units. Signal 
selection performs failure detection for a group of units when one of the signals 
miscompares. Isolation is done by ignoring the faulty signal in future comparisons. The 
selection (or determination) of the "good" signal accomplishes any needed reconfiguration. 
This method is well suited to specify redundancy separately for each type of unit based on 
its inherent reliability. 

A final reconfiguration approach that can be used with certain types of units (processing 
and communication) is dynamic function allocation. In this method, identical units are 
used throughout the system. When a unit fails, a sophisticated management function 
assesses which top-level functions are affected and reassigns functions as necessary 
among the surviving units. Through dynamic reallocation, the management function can— 
as far as the identical units are involved— ensure that the top-level functions are affected 
by failures in reverse order of their criticality. This ensures the longest possible survival 
of the most critical functions. This reconfiguration approach makes the most efficient 
possible use of the available system resources through ambitious redundancy management. 

When the system does not have enough redundant units or has experienced many failures, 
other reconfiguration methods must be used. In these situations, loss of sensed 
information or actuation capability makes normal function performance impossible. The 
goal of reconfiguration then changes to providing degraded performance of the function. 
One method is to use alternative control laws. Alternative control laws are usually 
simpler and use substitute input parameters and/or modified gains on the unfailed 
actuators. Each specific failure configuration to be covered this way requires its own 
alternative control law. 

Another method of system reconfiguration involves using modeled data to derive an 
estimate of the signal lost from a failed sensor. This method, which usually results in 
degraded performance, uses system modeling approaches mentioned earlier and employs 
model-derived data that can be substituted for the lost sensor output. 
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The level of redundancy, complexity of the redundancy management provisions, and the 
"layout" or configuration of the redundant units are strongly interrelated when fault 
tolerance performance, initial cost, and life cycle cost aspects of the system are 
considered. 

7.7.2.4 Crucial System Redundancy Management 

Figure 58 shows the redundancy management processes used by the flight essential 
processor group (FEPG) of the proposed system. Details of the implementation are 
described in the following paragraphs. 

Sensor signal selection is accomplished using minimum-mean-square deviation criteria, 
and system elements are monitored for faults using a combination of hardware and 
software. Faults are primarily detected by cross-channel comparison of the output 
maximum-mean-square value that exceeds a specified threshold. Inline monitoring 
supplements cross-channel comparisons and provides fault isolation. Following a failure 
that leaves only two paths for a function, a disagreement between these two paths will be 
accomplished by comparison with a simplified mathematical model using a 
maximum-mean-square error criteria and thresholding. 

Crucial elevator control and short-period pitch-augmented stability (PAS) functions are 
performed with the use of quadruple dedicated pitch sensors and triply redundant gain 
control signals. These signals are supplied to quadruple computers that calculate 
short-period PAS and also perform the fixed-gain Essential PAS computation. The four 
computer outputs are cross-channel interfaced into three actuator control channels and a 
mathematical model channel that is used for comparison. This configuration has a failure 
probability of less than 10”^. The signal selection process is based on the 
minimum-mean-square error criteria; i.e., each signal is compared with the mean value of 
the remaining signals. The squared difference signal that provides the minimum error 
signal is then selected; furthermore, if the square difference signal exceeds a given 
threshold, then that signal is assumed to be from a faulty channel. 

The function named "signal compare" is slightly different in that a specific signal is 
compared with the remaining signals. If that specific signal is within a predefined 
tolerance window, then that signal is selected. If the signal is declared faulty, another 
signal will be selected or, depending on the function, a shutdown signal sent. 
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7.7.3 REDUNDANCY DETERMINATION 


Subsection 6.2 describes how top-level function criticality was determined based on the 
impact of function loss on the safety or operation of the airplane. This criticality was 
used as a ground rule in grouping subfunctions together in architectural elements and as a 
guideline to interconnection of these elements. Once the concept architecture was 
defined in enough detail, the next step in the development approach was to analyze its 
failure behavior. In a full development effort, results of the analysis would be used to 
modify the concept architecture (partitioning and interconnections) iteratively to improve 
the resulting performance and failure behavior of the top-level functions. As mentioned 
previously, a strong interaction exists between the three architectural aspects of 
grouping, interconnection, and redundancy management. However, because the 
redundancy management methods have such potential for large overhead increases in the 
system, they are treated in a later step in this development approach. 

Some comments should be made about the first fault analysis to be performed on the 
concept architecture. The physical architecture at this point is defined at a high level, 
and the emphasis is on functions rather than hardware components. Again, a purpose of 
this development approach is to introduce reliability concepts into the early phases of the 
design process. The premise is that design refinements made at this level have a high 
payoff potential compared to making refinements or changes later in the cycle when there 
is a more detailed system definition. Because this is a high-level definition of a system 
that will use hardware not yet developed, no experience data will be available to allow 
quantitative reliability analyses. Consequently, traditional reliability analysis methods 
will have to be slightly modified to be used in the conceptual design phase. The emphasis 
will have to be on qualitative rather than quantitative improvements. Quantitative 
methods in the early design phases must be limited to trade studies with assumed 
reliability numbers. Later in the development cycle, when the system hardware has been 
specified, traditional quantitative methods will be used. For the first look at the fault 
tolerance of the concept architecture, a modified fault and failure analysis was 
performed. 

A fault and failure analysis is a procedure that evaluates the effects of potential failures 
on a system. What is of interest is the effect of failures on the top-level system 
functions. The ’’worst case” fault and failure analysis method was used to perform a 
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high-level qualitative evaluation of the preliminary architecture. The method identifies 
all top-level functions affected by a single element worst case failure. For this study, the 
worst case failure considered was the total loss of all subfunctions contained in an 
element. Use of a few more "generic" subfunction failure types may prove to be worth 
the additional effort to identify additional weaknesses at this design phase. 

The worst case method applied to architectural elements is similar to the criticality 
assessment method discussed in Subsection 6.2. A criticality is assigned to each element 
based on the consequences of the total loss of each element. This method will show 
whether the conceptual grouping of subfunctions, the numbers and types of top-level 
functions a particular element supports, or an element's interconnections will cause an 
element to be especially critical. Based on this criticality, grouping and interconnection 
aspects of the conceptual architecture can be changed to lower the criticality of 
elements, or highly critical elements can be identified for redundancy management 
provisions. 

Appendix D presents unit criticality assessment sheets showing the results of the analysis. 
Figure 59 presents the criticality category results for the preliminary architecture units. 

Remaining Concerns— Several of the major concerns resulting from the initial analysis of 
the preliminary architecture should be mentioned. Future investigation of these concerns 
would guide the succeeding conceptual design iterations to improve the fault behavior of 
the system. Central failure of any of the data buses leads to at least a large loss of 
system redundancy and possibly a large loss of system capability. In the preliminary 
architecture, elements of different criticality are connected to the same bus. The data 
bus interface design must prevent lower criticality element failures from causing a 
central bus failure. Otherwise, faults in lower criticality units could affect the higher 
criticality units. (A standard bus terminal design feature was assumed to make this 
possibility extremely remote in the development of the conceptual architecture.) 

Using a set of full-authority and a set of limited-authority secondary actuators would 
significantly increase airplane initial and life cycle costs. It also degrades the reliability 
and performance of the overall system by introducing more moving parts, which are 
subject to wear and breakdown. Eliminating the secondary actuators will have a major 
impact on the architecture and will require further study. 
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Figure 59. Criticality of Units 
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8.0 ACT/CONTROL/GUIDANCE SIMULATION REQUIREMENTS 


This section describes the program requirements for simulation of an integrated Active 
Controls Technology (ACT) Control/Guidance System with pilot in the loop. These 
simulation requirements provide decisionmaking planning information concerning potential 
implementation of the simulation. For most effective use, implementation of the 
simulator should commence early with long-lead items. As initial requirements for 
software and hardware are defined, preliminary simulation operational tests can begin. 
Simulator development then would continue parallel to analytic and concept definition 
efforts for the ACT avionics and control and display systems, which will provide effective 
evolution of information and total ACT control and display concepts. The final definition 
of implementation requirements will be produced as more comprehensive simulation test 
plans are completed and phased into mockup evaluations and preliminary simulations. 

8.1 SIMULATION SCENARIO 

A detailed preliminary scenario was constructed (app. E) to provide a baseline for 
derivation and planning of simulation requirements and specification of simulator design 
requirements. This scenario, which would be expanded and refined in future ACT studies, 
was structured in accordance with prime functions for each flight segment and is shown in 
Table 15. 

For the initial development, a baseline flight scenario from Chicago to Denver was 
selected as representative of a composite in density and traffic variations for a modern 
air carrier. The basis for determining operational capability in a technologically advanced 
flight deck is provided by systematically identifying all tasks the airplane crew must 
perform. This has been done in the task analysis and is presented in detail in Appendix E, 
with reference to flight deck locations and functions of controls and displays listed in 
Appendix C. 

The scenario, including flight profile and flight plan, reflects next-generation commercial 
transport flight operations. 
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Table 15. ACT Airplane Functions and Design Considerations 


Segment 

Takeoff 

Climb 

Prime 

functions 

A. Control airplane during takeoff and 
transition 

B. Maintain communications 

A. Control airplane through climbout 

B. Navigate to cruise course 

C. Maintain communications 

Prime 

function 

modifiers 

A. Control 

1. Handling quality 

a. Lateral, longitudinal, and directional 
stability and control 

(1) Takeoff roll 

(2) Rotation 

(3) Transition to ctimb 

b. Control system dynamics, primary 
flight control 

(1) Augmented 

(2) Unaugmented 

2. Crew-equipment interface 

a. Crew workload 

(1) Control requirements 

(2) Number of tasks 

(3) Displays and controls 

(a) Integration 

(b) Accessibility 

(4) Task allocation 

(5) Crew station environment 

(6) Operating time 

b. Crew accuracy 

( 1 ) Display readouts and control 
adjustments 

(2) Correlating takeoff requirements 
with display and control response 

(3) Decision 

B. Communications 

1. Communication system effectiveness 

2. Communication system utility 

3. Crew-equipment interface 

a. Equipment arrangement 

b. Control and display presentation 

c. Communication procedures 

A. Control 

1. Handling quality 

a. Lateral, longitudinal, and directional 
stability and control 

(1) Landing gear, flap, and slat 
retraction 

(2) ACT controls 

(3) Subsonic climb 

b. Control system dynamics 

(1) Primary flight control 

(a) Augmented 

(b) Unaugmented 

(2) Automatic flight control 

2. Crew-equipment interface 

a. Crew workload 

(1) Number of tasks 

(2) Control requirements 

(3) Displays and controls 

(a) Integration 

(b) Accessibility 

(4) Crew station environment 

(5) Task allocation 

(6) Operating time 

b. Crew accuracy 

(1 ) Display readouts and control 
adjustments 

(2) Correlating climb requirements 
with display and control response 

(3) Decision 

B. Navigation system effectiveness 

1. Subsystem utility 

2. Crew-equipment interface 

a. Crew workload 

(1) Number of tasks 

(2) Task allocation and procedures 

(3) Operating time 

b. Crew station arrangement and 
environment 

3. Equipment accuracy 

C. Communications 

1. Communication system effectiveness 

2. Communication system utility 

3. Crew-equipment interface 

a. Equipment arrangement 

b. Control and display presentation 

c. Communication procedures 

Simulator 
types 
applicable 
to above 
items 

Flight control simulator (fixed base).'A.1.a, 
A.I.b, A.2.a,A.2.b 

Full crew station simulator (fixed base) : A.1 .a, 
A.1 .b, A.2.a, A.2.b, B.1 , B.2, B.3.a, B.3.b, B.3.c 
Full crew station simulator (with external vision 
cues) : A.1 .a, A.1 .b, A.2.b 

Flight control simulator (fixed base): A.1 .a, 

A.1 .b, A.2.a, A.2.b 

Full crew station simulator (fixed base): A.1 .a, 
A.1 .b, A.2.a, A.2.b, B.1 , B.2.a, B.2.b, C.1 , C.2, 
C.3.a, C.3.b, C.3.c 




Table 15. ACT Airplane Functions and Design Considerations (Continued) 


Segment 

Cruise 

Descent 

Prime 

functions 

A. Control airplane during cruise 

B. Navigate on course 

C. Maintain communications 

D. Relieve crew fatigue 

A. Control airplane through descent 

B. Navigate to landing 

C. Maintain communications 

Prime 

function 

modifiers 

A. Control 

1. Handling quality 

a. Lateral, longitudinal, and directional 
stability and control 

(1) ACT controls 

(2) Subsonic flight 

b. Control system dynamics 

(1) Primary flight control 

(a) Augmented 

(b) Unaugmented 

(2) Automatic flight control 

2. Crew-equipment interface 

a. Crew workload 

(1) Control requirements 

(2) Number of tasks 

(3) Displays and controls 

(a) Integration 

(b) Accessibility 

(4) Operating time 

(5) Crew station environment 

(6) Task allocation 

b. Crew accuracy 

(1) Display readouts and control 
adjustments 

(2) Correlating climb requirements 
with display and control response 

(3) Decision 

(4) Ride quality 

B. Navigation system effectiveness 

1. Subsystem utility 

2. Crew-equipment interface 

a. Crew workload 

(1) Number of tasks 

(2) Operating time 

b. Crew station arrangement and 
environment 

3. Equipment accuracy 

C. Communications 

1 . Communication System effectiveness 

2. Communication system utility 

3. Crew-equipment interface 

a. Equipment arrangement 

b. Control and display presentation 

c. Communication procedures 

D. Crew fatigue 

1. Ride quality 

2. Crew station arrangement and 
environment 

a. Rest 

b. Food 

c. Sanitation 

d. Exercise 

A. Control 

1. Handling quality 

a. Lateral, longitudinal, and directional 
stability and control 

( 1 ) Low-speed dynamics 

(2) Gear, flaps, and slat extension 

(3) ACT controls 

b. Control system dynamics 

(1) Primary flight control system 

(2) Automatic flight control system 

2. Crew-equipment interface 

a. Crew workload 

(1) Control requirements 

(2) Number of tasks 

(3) Displays and controls 

(a) Integration 

(b) Accessibility 

(4) Operating time 

(5) Crew station environment 

(6) Task allocation 

b. Crew accuracy 

(1 ) Display readouts and control 
adjustments 

(2) Correlating descent requirements 
with display and control response 
actions 

B. Navigation system effectiveness 

1. Subsystem utility 

2. Crew-equipment interface 

a. Crew workload 

(1) Number of tasks 

(2) Operating time 

(3) Crew station arrangement and 
environment 

(4) Task allocation and procedures 

b. Crew accuracy 

(1) Display and control operation 

(2) Decisions 

3. Equipment accuracy 

C. Communications 

1. Communication system effectiveness 

2. Communication system utility 

3. Crew-equipment interface 

a. Equipment arrangement 

b. Control and display presentation 

c. Crew-equipment interface 

(1) Equipment arrangement 

(2) Control and display presentation 

(3) Communication procedures 

Simulator 
types 
applicable 
to above 
items 

Flight control simulator (fixed base): A. 1. a, 

A.1 .b, A.2.a, A.2.b 

Full crew station simulator (fixed base): A.1. a, 
A.1 .b, A.2 .a, A.2.b, B.1 , B.2.a, B.2.b, C.1 , C.2, 
C.3.a, C3.b, C.3.c f D.2 

Full crew station simulator (with motion): A.1. a, 
A.1 .b, A.2.a, A.2.b, B.2.a, C.3, D.1 

Flight control simulator (fixed base): A.1. a, 
A.1 .b, A.2.a, A.2.b 

Full crew station simulator (fixed base): A.1 .a, 
A.1 .b, A.2.a, A.2.b, B.1 , B.2.a, B.2.b, C.1 , C.2, 
C.3.a, C.3.b, C.3.c 
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Table 15. ACT Airplane Functions and Design Considerations (Concluded) 



Segment 

Landing 


Prime 

functions 

A. Control airplane through approach and landing 

B. Navigate to runway 

C. Maintain communications 


Prime 

function 

modifiers 

A. Control 

1. Handling quality 

a. Lateral, longitudinal, and directional 
stability and control 

( 1 ) Low-speed dynamics 

(2) Landing flare 

b. Control system dynamics 

(1) Primary flight control 

(2) Automatic landing control 

2. Crew-equipment interface 

a. Crew workload 

{ 1 ) Control requirements 

(2) Number of tasks 

(3) Displays and controls 

(a) Integration 

(b) Accessibility 

(4) Operating time 

(5) Crew station environment 

(6) Task allocation 

b. Crew accuracy 

(1) Display readouts and control 
adjustments 

(2) Correlating landing requirements 
with display and control response 
actions 

(3) Decision 

B. Navigation system effectiveness 

1. Subsystem utility 

2. Crew-equipment interface 

a. Crew workload 

(1) Number of tasks 

(2) Operating time 

(3) Crew station arrangement and 
environment 

(4) Task allocation and procedures 

b. Crew accuracy 

(1) Display and control operation 

(2) Decisions 

(3) Ride quality 

3. Equipment accuracy 

C. Communications 

1. Communication system effectiveness 

2. Communication system utility 

3. Crew-equipment interface 

a. Equipment arrangement 

b. Control and display presentation 

c. Communication procedures 


Simulator 
types 
applicable 
to above 
items 

Flight control simulator (fixed base): A.1 .a, 
A.I.b, A.2.a, A.2.b 

Full crew station simulator (fixed base): A.1 .a, 
AJ.b, A.2.a, A.2.b, B.1 , B.2.a, B.2.b, C.1 , C.2, 
C.3.a, C.3.b, C.3.c 

Full crew station simulator (with motion and 
external vision): A.1 .a, A.I.b, A.2.a, A.2,b, 

A.1 .b 
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To completely evaluate the man-system interface, especially as affected by ACT function 
failures and marginal handling qualities, such failures or abnormal operation of 
representative systems and subsystems must be simulated during appropriate flight 
phases. For maximum simulation validity, these abnormal operations must be integrated 
into normal operations in a realistic environment such that the crew is tested in response 
patterns and priorities of duties. This yields accurate data about handling qualities, 
control and display effectiveness, and the simulation methods themselves. Table 16 lists 
typical non-ACT abnormal procedures that might apply to any 1990s airplane. These 
simulated failure capabilities will also be available in the ACT simulator, permitting a full 
appraisal of overall workload capability for worst case ACT airplane operations. 

Emergency procedures are similar to abnormal procedures in that neither occurs 
frequently in real operations, but in a developmental simulator the capability must exist 
to thoroughly explore such man-system interface effects and response capability and 
reserve. The primary difference between abnormal and emergency procedures is that 
abnormal procedures seldom affect the specific flight profile that has been planned. 

Emergency procedures, however, quite often will totally and drastically change the flight 
profile (e.g., rapid decompression). In a matter of minutes, the available range of the 
airplane may not equal the range to the planned destination. Some emergency procedures 
can tax the crew to the maximum extent because of simultaneous critical-action control 
requirements, rapid system and subsystem operation or modification, decisionmaking, 
communications, and navigation. In this environment, a flaw in the man-system interface 
may appear sooner than anywhere else. Accordingly, it is essential that such problems be 
detected and resolved in the benign environment of a simulator. Table 17 lists typical 
emergency procedures that might apply to the ACT-configured airplane. These 
capabilities should also be available in the simulator. 
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Table 16. Typical Non-ACT Abnormal Procedures 



Abnormal procedure 

Engine 

Engine start in flight 

Engine failure and shutdown 

Engine shutdown maintenance information 

One engine inoperative landing and missed approach 

Inadvertent thrust reversal in flight 

Reverse thrust, reverse unlock, or reverse valve open 

Engine oil pressure low 

Engine oil strainer clog 

Fuel dumping 

Fuel dumping 

Electrical 

Generator bus failure 
dc loadmeter zero 
Generator fail 
Generator off 

Constant-speed-drive oil temperature high 
Constant-speed-drive oil pressure low 

Hydraulics 

Hydraulic temperature high 
Hydraulic temperature gage high 
Hydraulic pump low pressure 
Hydraulic pressure gage low 
Hydraulic quantity loss 

Flight controls 

Landing with normal flaps and abnormal slats 
Landing with normal slats and abnormal flaps 
No-flap/no-slat landing 
Stabilizer inoperative landing 

Landing gear 

Antiskid fail 

Gear unsafe with gear handle down 
Gear unsafe with gear handle up 
Gear handle will not go to up position 
Gear handle will not go to down position 

Air-conditioning 

smoke 

Air-conditioning and pneumatic supply smoke 
Cockpit smoke removal— unpressurized 
Ram air ventilation system operation 

Anti-ice cockpit 
window 

Engine or wing— anti-ice valve inoperative 
Pitot heat inoperative 
Cockpit window failure 
Windshield anti-ice inoperative 

Ditching 

Ditching and ditching evacuation 
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Table 17. Typical ACT Airplane Emergency 
Procedure Conditions 


Emergency procedure condition 


Short-period PAS failure 
Rapid decompression 
Engine fire or severe damage 
APU fire 

All engines flame out 
Loss of all generators 
Electrical smoke of unknown origin 
Pneumatic temperature failure 


8.2 GENERAL SIMULATION REQUIREMENTS 

The simulation requirements discussed in this subsection are presented in terms of tasks 
and task objectives, simulation design and evaluation tools used, and preliminary schedule 
and cost estimates. The importance of relating the simulation program to the airplane 
development program is to be considered implicit throughout. 

Figure 60 shows a block diagram of all flight simulations to be considered. The figure 
applies throughout the range of simulation sophistication, as the actual mechanization of 
simulation can vary from a simple, single-task, fixed-base cockpit-computer combination 
to a complex, multitask experiment that could include such sophisticated capabilities as 
moving-base and external vision cues. For the present discussion, it will cover simulation 
from early handling qualities efforts through flight support evaluations for an ACT 
airplane. 

Detailed planning of expected handling qualities and control and display refinements 
exceeded the scope of the current effort. A more explicit definition of design questions is 
needed as part of planning simulation goals and simulation design tools. An extended 
review of the simulation implications of all systems is only part of the effort required to 
produce an overall test program plan that consists of a series of individual simulation test 
plans. 
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Figure 60. Flight Simulation Diagram 




164 






The present study provides a general scope of requirements involved in the simulation 
program that is deemed necessary for all system development phases. The requirements 
relate to the time period from the end of the present study through airplane test. A more 
extensive definition of the factors significant to such a program is needed in the next 
study phase. 

8.2.1 ACT AVIONICS AND CREW SYSTEM SIMULATION TASKS 

Under a separate task, but concurrent with work on this IAAC task, a piloted simulation 
study of the Boeing 757 airplane was conducted at aft center-of-gravity (eg) locations 
with an ACT system. The study was done to show the feasibility of providing good 
handling qualities at extremely aft eg locations within the operational and design flight 
envelopes. The results of this study are documented in Reference 20. 

Evaluations were made of the unaugmented airplane, the airplane with an Essential Pitch- 
Augmented Stability (PAS) System, and the airplane with a full-capability Primary PAS 
System. Acceptable (with improvements warranted) pilot ratings were attained aft to 
about 57% mean aerodynamic chord (MAC) or 6% aft of the neutral point for 
unaugmented landing approach. For Mach = 0.80 unaugmented cruise, acceptable ratings 
(with improvement warranted) were attained to 47% MAC or 5% forward of the maneuver 
point. The augmented airplane model provided handling qualities close to, or within, a 
good (no improvements necessary) rating at all tested eg locations for both the Essential 
and Primary PAS Systems. Analyses of the test conditions, applied to existing handling 
qualities criteria, agreed well with the unaugmented airplane ratings. However, 

modifications of some of the criteria are suggested by the augmented airplane ratings. 

The simulations of the present phase (table 18) would require a simulation study of 
significantly greater scope during actual flight readiness testing. Demonstration of flight 
readiness of detailed augmentation system designs, ensuring manageable manual reversion 
for all flight and control and display workload conditions, will require simulation testing 
of ACT flight test hardware, flight-standard processors, and associated control laws. 

The scope of a "first cut" simulation would be similar to that of the earlier (ref 20) piloted 
simulation, extending earlier information to correlate with design differences. However, 


165 



Table 18. Representative Handling Qualities Simulations 


757 Simulation Test Flight Conditions 






Flight 





1 

Neutral 

Maneuver 

Condition 

weignt 

Gear 

path 
angle, 7 

V 

e 

Mach 

No. 

Altitude 

point 

point 


kg 

(lb) 


deg 

m/s 

(KEAS) 

m 

(ft) 

Percent 

MAC 

Percent 

MAC 

Landing 

89 813 

(198 000) 

Up 

-3.0 

69 

(134) 


305 

(1 000) 

48 

65 

conditions 

89 813 

(198 000)* 

Down 

-3.0 

69 

(134) 


305 

(1 000) 

50.5 

62 


89 813 

(198 000) 

Down 

0 

69 

(134) 


305 

(1 000) 

49 

62 


73 483 

(162 000) 

Down 

-3.0 

63 

(123) 


305 

(1 000) 

51 

71 

Cruise 

86 184 

(190 000) 

Up 

0 



0.80 

10 668 

(35 000) 

41* 

52 

conditions 

83 462 

(184 000)* 

Up 

0 



0.80 

10 668 

(35 000) 

36 

52 


83 462 

(184 000) 

Up 

0 



0.82 

10 668 

(35 000) 

31 

48 


83 462 

(184 000) 

Up 

0 



0.84 

10 668 

(35 000) 

33 

47 


83 462 

(184 000) 

Up 

0 



0.80 

11 887 

(39 000) 

42 

51 


74 844 

(165 000) 

Up 

0 



0.82 

11 887 

(39 000) 

40 

47 


83 462 

(184 000) 

Up 

0 



0.82 

12 802 

(42 000) 

- 

46 


83 462 

(184 000) 

Up 

0 



0.86 

8 230 

(27 000) 

- 

50 


83 462 

(184 000) 

Up 

-4.9 



0.91 

7 620 

(25 000) 

- 

58 


83 462 

(184 000) 

Up 

0 



0.63 

3 050 

(10 000) 

39 

55 


83 462 

(184 000) 

Up 

0 

100 

(195) 


7 620 

(25 000) 

44 

51 

Climb 

condition 

(maximum 

power) 

74 844 

(165 000) 

Up 

10.0 

144 

(280) 


3 050 

(10 000) 

31 

57 


* Principal simulation test conditions. 


Pilot Simulation Maneuvers 


Low-speed maneuvers 
Approach and landing or go-around 

Initial conditions 

SX = -6096m (-20 000 ft}, SY = 305m (1000 ft) 

Alt = 1 52m (500 ft), 7 = 0 deg. V e - 1 .3Vs + 103 m/s (20 kn) 
Gear up, flaps = 20 deg 


Flight profile 

• 1.5 dot below glide slope— gear down 3 

• 1.0 dot below glide slope-flaps 30 deg, reduce to 1.3V<j 

• Glide slope capture 

• Approach on instruments at 1.3V<j 

• "Breakout" at 30.5m (100 ft) 

• Land 
or 

• Go-around at 15.2m (50 ft), full power, flaps = 20 deg 

• Gear up at positive rate of climb 

With and without moderate turbulence and 103-m/s (20-kn) crosswind 
at 12.2m (40 ft) 

(cr u , o v , o w ) - (1.52, 1.52, 0.76) (m/s) (rms) 

((5.0, 5.0, 2.5) (ft/s) (rms) 

Reference speeds 

74 844 kg (165 000 lb) 1.3V S = 63 m/s (123 kn) 

89 813 kg (198 000 lb) 1.3V $ - 69 m/s (134 kn) 


High-speed maneuvers^ 

Still air 


• Roller coaster 

A'z * ±0.5g 

• Altitude change 

Aalt * ±91. 4m (300 ft) 

• Speed change 

Au * ±7.7 m/s (1 5 kn) 

• Roll in/out 

A<£ ^ 30 deg. Ai£ = 1 5 deg 

Turbulence (moderate) 

• Altitude change 

Aalt = ±9 1.4m (300 ft) 

• Roll in/out 

A# = 30 deg, A^> “15 deg 


a 

b 


1.0 dot indicates approximately 0.35-deg deviation from glide slope. 
Initial conditions within the flaps-up flight envelope boundaries are 
applicable. 


Source: Boeing (ref 20). 
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beyond such a first-cut simulation effort, all of the failure modes will have to be analyzed 
and evaluated. The detailed simulation would include exhaustive evaluation of ACT 
system functions and failures superimposed on the system and crew workloads of normal 
flight phases. 

Simulation of a 1990s ACT airplane flight deck, the controls and displays of which are 
interactive with an integrated ACT avionic system, will encompass the following task 
groups: 

Group 1— System architecture selection and simulation implementation engineering 

Group 2— System failure modes and effects analysis and selection of failure modes 
to be simulated 

Group 3— Simulation scenario(s) refinement with superposition of selected ACT 
failures 

Group 4— Simulation cab layout design, accommodating expected ACT failure mode 
influence on crew task priorities 

Group 5— Iterative simulation experiments for data collection 

Group 6— Data analysis and conclusions abstraction 

Task Objectives— The preceding task groups will provide determinations in the following 
three major investigative areas: 

• Handling qualities will require extensive iterative simulation. While Reference 20 
provides data for one tightly bounded, relaxed-stability experiment, it remains to 
refine controllability of an ACT airplane for normal operations and to resolve 
handling qualities characteristics for all degraded modes. A variety of degraded 
modes is possible, each with potentially more significant impact on controllability 
than experienced with more traditional airplanes. 


A 
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• The pilot’s control and display interface for primary flight control will require 
dedicated attention and may need some significant design modifications tailored to 
handling qualities evolution. Combinational failure modes could result in a 
marginally unstable airplane in an environment that severely restricts the pilot’s 
options for correction of the condition. Skill and workload demands on the crew will 
change with variations in handling qualities, and special display formatting features 
are expected to be necessary to ensure and enhance pilot awareness, comprehension, 
and effective control. Past experience with such features as the electronic 
horizontal situation indicator (EHSI) ’’trend vector” has shown that the pilot's control 
capability and responsiveness to new situations can be improved by displaying status, 
trends, rates, and overall predictor information. 

• The handling qualities control and display workload must be demonstrated to be 
manageable in context with total system management and control. As the full range 
of failure modes affecting manual flight control capabilities is resolved, a new, ACT- 
related workload baseline will emerge for the primary flight control task. Design 
questions may arise regarding crew workload reserve for other key flight and system 
management duties, requiring extensive simulation to ensure effective total control 
and display system formatting for monitoring and controlling the other airplane 
systems. Accordingly, periodic appraisals of the total flight deck workload would be 
necessary as part of the simulation evaluations, leading to total flight deck 
simulation. 

The data developed during work on the preceding three major interest areas should 

produce answers and conclusions regarding: 

• Handling qualities versus envelope boundaries for all flight phases 

• Effects on handling qualities of the various control laws applied 

• Effects on both handling qualities and crew workload of the selected modes of system 
failures imposed 

• Design modifications or implications for the interface between the flight deck and 
crew systems resulting from the preceding three items 

• Design modifications or implications that all of the preceding impose on the 
simulated ACT avionics and crew system integrated system 
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8.2.2 ACT AVIONICS AND CREW SYSTEM ELEMENTS AND FUNCTIONS SIMULATED 


The choice of system elements requiring simulation as equipment items— as contrasted 
with functions to be simulated— is a subtask of a future phase of work, falling within the 
Group 1 and Group 4 tasks described in Subsection 8.2.1. In general, however, because it 
is finally the crew that is being tested in the measurement of airplane handling qualities 
and workload manageability, the system elements that provide the crew its interface have 
unquestioned influence on test results. The benefits or drawbacks of a multifunction 
display panel with keyboard to crew task performance cannot be extrapolated from 
simulating such a device with electromechanical displays and switch sets, for example. 
For these reasons, flight deck elements of the system require close physical and 
manipulative simulation. 

In general, other system elements may be simulated in terms of their interactive 
functional effects at the flight deck interface. Function generation or simulation is the 
design task rather than the element emulation. 

Flight Deck Simulation— The ACT avionics systems required to be simulated at the flight 
deck interface cover three prime areas: ACT-unique functions, control and display 

integration, and new-technology displays. Each of these areas requires careful simulation 
for development, integration, workload analysis, and degraded mode analysis. 

The ACT-unique functions are grouped into the following types of functions: 

• Control Functions — The control functions are minimal, considering the inherent 
transparency of the ACT systems. The only immediately obvious controls will be the 
emergency disconnect switches located on the overhead flight control panel. These 
switches will be guarded switches capable of being reset after a disconnect. There 
will be one switch for each of the individual ACT functions (speed PAS, 
lateral/directional-augmented stability, wing-load alleviation, maneuver- load 

control, gust-load alleviation, and angle-of-attack limiting). The only other controls 
consist of test initiation switches used to start the mechanical and electrical test 
sequences, respectively. Rather than using dedicated switches, these functions would 
be controlled through the multifunction keyboard as part of the preflight operational 
sequence. 
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• System Status Functions — ACT system status is monitored directly through the 
systems display and crew alerting systems. The systems display will show ACT 
system status only upon pilot request and any present system faults and list flight 
restrictions as applicable. The crew alerting system will provide fault annunciation 
on a real-time basis. The level of alert will be commensurate with the severity of 
the fault as it impacts the entire ACT system. 

• Maintenance Functions — The ACT maintenance functions recognize and store 
information on three levels of faults: 

• Faults that have no effect upon airplane dispatchability 

• Faults that allow dispatch but with some restriction to the flight plan 

• Faults that prevent dispatch 

These functions will be included in the crew alerting system, which allows storage of all 
system faults. The crew alerting system information could also be data linked to ground 
operations through the ARINC communication addressing and reporting system (ACARS). 

Control and display integration is a most important area, as reversion to manual control 
of the ACT airplane could require improved predictor displays and special-purpose 
formatting and display dynamics. This area perhaps requires the most simulation, 
commencing with earlier handling qualities effort to ensure overall compatibility of pilot 
control and display characteristics with airplane response. For the ACT airplane, this 
integration involves several new flight deck controls and displays that have been evolving 
and that are expected to enhance pilot operation and control. The following controls and 
displays are now sufficiently mature and ready to start the application-refinement process 
to enhance flight deck control of operations and to aid in workload control: 

• Centralized crew alerting system 

• Multifunction control and display unit 

• Engine and system monitor displays 

• Integrated communication and navigation panel 

• Electronic secondary displays 
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New-technology displays to support control and display integration include expanded use 
of color cathode-ray tubes (CRT), introduction of flat panel displays (i.e., light-emitting 
diode and thin-film electroluminescence), and development of holographic head-up display 
projection. Color CRT use in the cockpit is becoming commonplace; therefore, much 
analytical data and experience will be available to the designers and system integrators, 
reducing simulator development and testing hours. Flat panels, being new to the cockpit, 
will require greater system development and testing. Similarly, the head-up display will 
require more hardware refinement. Head-up display software and associated drive 
algorithms are presently being developed, tested, and refined jointly by industry, FAA, 
and NASA. This work will valuable to the simulation system development. 

Some of these concepts are already being developed, such as the centralized caution, 
warning, and advisory system on the Boeing 757/767 airplanes and the radio management 
system under development for the Boeing 737-300 airplane. Significant refinements (e.g., 
dynamics and formatting) are feasible and desirable for the ACT airplane to ensure that 
the flightcrew has basic backup flight control capability for all normal and failure modes. 
In addition, new system management concepts are expected to be necessary to alleviate 
crew workload during manual reversion. New questions to be addressed in simulation 
integration will extend earlier control and display integration concepts and also deal with 
interaction of the multifunction control and display unit and the engine and system 
monitor displays. 

It remains to extend the present definition of simulation requirements into a specific test 
planning activity. Such effort is beyond the scope of the present effort but is 
recommended for more efficient evolution of the simulation program. The detailed test 
plans will be based on the scenario and function-action-information requirements of 
Appendix E. The planning activity would ensure outlining not only representative normal 
flight mission requirements but also incorporating (in context) various degraded modes 
that might occur. Initial evolution of the scenario will be modified and extended 
significantly as feedback and updating continue. Simulation planning herein is based on 
the present definition phase for the scenario and is subject to updating. 
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8.3 RECOMMENDED SIMULATION MECHANIZATION 


n 


The recommended simulation mechanization, details of which are given in Appendix F, 
closely follows design testing and handling qualities verification proven valid in similar 
Boeing programs. 

The simulation would require a general-purpose (fixed base) cab, selected support use of a 
motion simulator cab, multiprocessor computer system availability, cab device 
development effort, and scenario-unique software development in addition to real-time 
simulations and data analysis tasks. 

The engineering budget estimate for such a mechanization is approximately $3 million for 
pretest costs of labor, hardware, and cab devices and between 30 and 40 man-years of 
simulation team effort in software design, simulation testing, and data analysis. 


n 




172 



9.0 CONCLUDING REMARKS AND RECOMMENDATIONS 


In this project, stipulation of a 1990s ACT-configured airplane provided a sufficiently long 
look into the future to realistically accommodate an expected evolution of design 
methodology, as applied to commercial air transports. A top-down avionic system design 
and development approach is a departure from the methods traditionally used by 
commercial airframe manufacturers; i.e., aerodynamics, structures, and propulsion have 
always dominated the engineering process, with individual avionic systems being added 
randomly where needed on the airplane because of the services that they provide. But the 
avionic systems are now beginning to play an important role in fuel economy, airplane 
safety (e.g., collision avoidance), flight comfort, and flight operations. Moreover, digital 
electronics and all-electric actuators may eventually replace many hydraulic systems, 
providing weight and cost savings and improved maintainability. 

This ACT/Control/Guidance System study provided the first opportunity to apply a 
systematic top-down approach to avionic system design, generally unconstrained by 
preconceived notions of what the system architecture should be. Discussions with 757/767 
program people also benefited this ACT study considerably; because the 757/767 airplanes 
are the first M all digital" commercial transports, many valuable lessons have been learned 
that can be applied to the next-generation system. 

Analysis of the preliminary system architecture led to the conclusion that— as a 
consequence of elements of various criticalities being connected to a common bus— the 
data bus interface design must prevent lower criticality element failures from causing a 
central bus failure. Thus, a standard bus terminal design feature was assumed to make 
such a central bus failure possibility extremely remote. System reliability analyses for 
such an architecture would be heavily dependent on the ability to implement such a design 
feature. 

The system architecture alternatives examined included— among other aspects— backup 
systems providing degraded performance in lieu of the redundant, full-performance 
system; various ways of combining (or separating) processing functions; and such specifics 
as a choice between primary or secondary actuators and split control surfaces. Complete 
evaluation of some of these alternatives will require cost, weight, reliability, and 
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maintainability trade analyses. For others, there may even be a need for additional 

technology development before valid decisions can be made. 

Other principal conclusions and recommendations reached during the course of this work 

are: 

• A structured approach to hardware and software development will be very beneficial 
and perhaps essential to any future avionic system design. 

• The ACT/Control/Guidance System imposes no unusual constraints on flight 

operations and no additional functional capability for air traffic control (ATC) 
clearances. 

• Manpower and schedule constraints dictated that the flight deck functions be 

determined separately from but parallel to the rest of the avionics functions. 
Additional work will be required to achieve consistent integration of the two portions 
of the system. 

• The assumptions and constraints governing the system design proved to be 

satisfactory throughout this study. 

• No significant changes are foreseen for the required functions, the logical groupings, 
or the high-level data flow; however, all systems should have data flow developed to 
a degree at least equivalent to that shown for the "control and structural relief" 
group. 

• Functions such as electrical power should be addressed in any future work. 

• Details of the preliminary architecture are still at a fairly high level; it is expected 
that some of the architectural concepts (even at this high level) may change when the 
next lower level of detail is developed. During the study, it was found that two to 
four iterations were necessary at adjacent levels of design detail. 

• Potentially attractive system architecture alternatives have been identified. 
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A thorough analysis of system performance, including data bus loading, redundancy, 
software overhead requirements, growth capability, etc., must be performed before 
the next lower level of design detail is developed. 

User (airline) reaction to the new, integrated system concepts should be determined. 

The new system concepts should be examined and distributed by Aeronautical Radio 
Incorporated (ARINC) to ensure timely suggestions and consensus from the entire 
aviation community. 

Projections of hardware reliability must be developed. 

System software development and maintenance burden implications were addressed 
only in the ground rules and constraints affecting system architecture (i.e., there 
would be extensive use of common software functions, etc.). It is recommended that 
cost and reliability tradeoffs specific to avionic system structuring be studied 
further. 
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